Executive brief
The ThumbPress plugin for WordPress contains a flaw that allows low-privilege users (Subscribers and above) to deactivate the plugin without proper authorization. An authenticated attacker can send a specially crafted request to perform this action, potentially disrupting website functionality or removing security protections. This requires a valid WordPress account but no administrative privileges.
Technical details
The vulnerability is a capability check and nonce verification bypass in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-deactivation AJAX action. Authenticated attackers with Subscriber-level access can exploit this by sending a crafted POST request to admin-ajax.php to deactivate the ThumbPress plugin. The missing access controls allow privilege escalation via an unauthenticated or low-privilege account compromise.
Affected products
- ThumbPress ThumbPress up to and including 6.2.1
Timeline
- 2026-09-22: disclosed