Junglewise Threat Intelligence

CVE-2026-13432: ThumbPress WordPress plugin authorization bypass in AJAX deactivation

CVE-2026-13432 · Severity: info · CVSS 5.4 · Published 2026-07-20

Vendors: Unknown.

Executive brief

ThumbPress is a WordPress plugin used to manage image sizes and thumbnails. A security flaw allows any logged-in user, even those with low-level 'subscriber' permissions, to remotely deactivate the plugin. This can disrupt the website's appearance and image-handling features, potentially breaking the user experience for visitors.

Technical details

The ThumbPress plugin (also known as image-sizes) fails to implement proper authorization checks (CWE-862) on the 'pl-plugin-deactivation' AJAX action. An authenticated attacker with at least subscriber-level privileges can trigger this action via a POST request to admin-ajax.php without requiring a nonce or administrative permissions. Successful exploitation allows the attacker to deactivate the plugin, leading to a loss of image-management functionality on the site. The issue is resolved in version 6.2.2.

Affected products

  • Unknown ThumbPress (image-sizes) < 6.2.2

Timeline

  • 2026-06-29: disclosed: Publicly published by WPScan
  • 2026-06-29: patched: Fixed in version 6.2.2
  • 2026-07-20: advisory: NVD published date

References