ThumbPress vulnerabilities

The ThumbPress plugin for WordPress in versions up to and including 6.2.1 is vulnerable to unauthorized access due to missing capability checks and nonce verification in the send_deactivation_survey() function. An authenticated attacker with Subscriber-level access or higher can deactivate the ThumbPress plugin by sending a crafted POST request to admin-ajax.

ThumbPress versions prior to 6.5 contain an unauthenticated Broken Access Control vulnerability. Unauthenticated users can perform operations they are not authorized to do.

The ThumbPress WordPress plugin before version 6.2.2 lacks a capability check in one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the plugin, disrupting the site's image-handling functionality.

The ThumbPress WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects all versions from n/a through 6.3.2.