7 matches found
CVE-2026-110041
The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability the Author role by default to read the metadata of, and overwrite the generated thumbnail files...
CVE-2026-110041
The Crop Thumbnails WordPress plugin (versions before 1.10.0 ) is vulnerable to an authorization flaw because it fails to perform object-level authorization when reading and re-cropping media attachments. This allows any authenticated user with upload capabilities (such as the Author role) to acc...
CVE-2026-110041 Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints
The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability the Author role by default to read the metadata of, and overwrite the generated thumbnail files...
EUVD-2026-124270
The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability the Author role by default to read the metadata of, and overwrite the generated thumbnail files...
WordPress Crop Thumbnails plugin < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite vulnerability
Author+ Arbitrary Attachment Read and Overwrite vulnerability discovered by Pedro Pinho in WordPress Plugin Crop-Thumbnails versions 1.10.0...
CVE-2026-110041: Unknown Crop Thumbnails: The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and…
The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability the Author role by default to read the metadata of, and overwrite the generated thumbnail files...
PT-2026-145700
The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability the Author role by default to read the metadata of, and overwrite the generated thumbnail files...