CVE-2026-7622
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The ThumbPress plugin for WordPress in versions up to and including 6.2.1 is vulnerable to unauthorized access due to missing capability checks and nonce verification in the send_deactivation_survey() function. An authenticated attacker with Subscriber-level access or higher can deactivate the ThumbPress plugin by sending a crafted POST request to admin-ajax.
Risk Assessment
An attacker can deactivate the ThumbPress plugin, potentially causing loss of functionality such as thumbnail display issues.
Recommendation
Update the ThumbPress plugin to a version newer than 6.2.1 as soon as it becomes available.
Other vulnerabilities in ThumbPress
See all- CVE-2026-32549High
ThumbPress versions prior to 6.5 contain an unauthenticated Broken Access Control vulnerability. Unauthenticated users can perform operations they are not authorized to do.
- CVE-2026-13432Medium
The ThumbPress WordPress plugin before version 6.2.2 lacks a capability check in one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the plugin, disrupting the site's image-handling functionality.
- CVE-2026-57720Medium
The ThumbPress WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects all versions from n/a through 6.3.2.
Original NVD description (English source)
The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-deactivation AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the ThumbPress plugin on the affected site by sending a crafted POST request to admin-ajax.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS