CVE-2026-13432 PUBLISHED

ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation

Assigner: WPScan
Reserved: 26.06.2026 Published: 20.07.2026 Updated: 20.07.2026

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality.

Product Status

Vendor Unknown
Product ThumbPress
Versions Default: unaffected
  • affected from 0 to 6.2.2 (excl.)

Credits

  • Umut Can Yurdayardım finder
  • WPScan coordinator

References

Problem Types

  • CWE-862 Missing Authorization CWE