Executive brief
ThumbPress is a WordPress plugin used to manage image sizes and thumbnails. A security flaw allows any logged-in user, even those with low-level 'subscriber' permissions, to remotely deactivate the plugin. This can disrupt the website's appearance and image-handling features, potentially breaking the user experience for visitors.
Technical details
The ThumbPress plugin (also known as image-sizes) fails to implement proper authorization checks (CWE-862) on the 'pl-plugin-deactivation' AJAX action. An authenticated attacker with at least subscriber-level privileges can trigger this action via a POST request to admin-ajax.php without requiring a nonce or administrative permissions. Successful exploitation allows the attacker to deactivate the plugin, leading to a loss of image-management functionality on the site. The issue is resolved in version 6.2.2.
Affected products
- Unknown ThumbPress (image-sizes) < 6.2.2
Timeline
- 2026-06-29: disclosed: Publicly published by WPScan
- 2026-06-29: patched: Fixed in version 6.2.2
- 2026-07-20: advisory: NVD published date