Unrated severityNVD Advisory· Published Jul 20, 2026· Updated Jul 20, 2026
ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation
CVE-2026-13432
Description
The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality.
Affected products
1- Range: <6.2.2
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/a408e8f9-4de7-4449-8fca-51ea46e4f433/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.