CVE-2026-7622

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the senddeactivationsurvey function registered via the wpajaxpl-plugin-deactivation AJAX action. This makes it possibl...

CVE-2026-7622 ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the senddeactivationsurvey function registered via the wpajaxpl-plugin-deactivation AJAX action. This makes it possibl...

CVE-2026-7622 ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the senddeactivationsurvey function registered via the wpajaxpl-plugin-deactivation AJAX action. This makes it possibl...

CVE-2026-7622

The ThumbPress plugin for WordPress, in versions up to and including 6.2.1 , is vulnerable to unauthorized access. The root cause is a lack of capability checks and nonce verification within the send_deactivation_survey() function, which is registered via the wp_ajax_pl-plugin-deactivation AJAX a...

EUVD-2026-84308

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the senddeactivationsurvey function registered via the wpajaxpl-plugin-deactivation AJAX action. This makes it possibl...

PT-2026-96668

Name of the Vulnerable Software and Affected Versions ThumbPress versions prior to 6.2.2 Description Authenticated users with Subscriber-level access and above can deactivate the plugin by sending a crafted POST request to the 'admin-ajax' endpoint. This occurs because the send deactivation surve...

CVE-2026-7622: Missing Authorization

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the senddeactivationsurvey function registered via the wpajaxpl-plugin-deactivation AJAX action. This makes it possibl...

WordPress ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More plugin <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Deactivation vulnerability discovered by Que Thanh Tuan in WordPress Plugin ThumbPress versions = 6.2.1...

CVE-2026-32549

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-32549 WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

EUVD-2026-60911

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-32549 WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-32549

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-32549

The WordPress ThumbPress plugin (

PT-2026-77053

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-32549: Missing Authorization

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by 20kilograma in WordPress Plugin ThumbPress versions 6.5...

CVE-2026-13432

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality...

CVE-2026-13432 ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality...

EUVD-2026-45891

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality...