# CVE-2026-110041: WordPress Crop Thumbnails plugin authorization bypass in REST endpoints

Source: https://junglewise.ai/threats/cve-2026-110041-the-crop-thumbnails-wordpress-plugin-before-1-10-0-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-110041 · Severity: info · Published 2026-11-12

The Crop Thumbnails WordPress plugin before version 1.10.0 fails to properly check user permissions when accessing media files through its REST API endpoints. This allows any authenticated user (with author-level or higher privileges) to read metadata and overwrite thumbnail files and metadata of media attachments belonging to other users, potentially exposing sensitive file information and enabling data manipulation across the site.

Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2026-110041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110041 being exploited in the wild.

**How severe is CVE-2026-110041?** Informational severity, published 12 November 2026.

**Which products and versions are affected?** Wordpress Crop Thumbnails before 1.10.0.

**Is there a fix for CVE-2026-110041?** Yes: fixed in 1.10.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110041 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-110041?** Check whether you run Wordpress Crop Thumbnails at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.10.0

## Technical details

The plugin lacks object-level authorization checks in its crop REST endpoints, allowing authenticated users with the upload capability to read and modify metadata and generated thumbnails of attachments they do not own. This is a classic Insecure Direct Object Reference (IDOR) vulnerability accessible via REST API. An Author-role user can exploit this to access and overwrite metadata and thumbnail files of other users' media attachments.

## Affected products

- WordPress Crop Thumbnails before 1.10.0

## Timeline

- 2026-11-10: disclosed

## References

- [https://wpscan.com/vulnerability/f79fa2e0-ebba-4075-84d9-b5fadfbd6ca4/](https://wpscan.com/vulnerability/f79fa2e0-ebba-4075-84d9-b5fadfbd6ca4/)