CVE-2026-110041

The Crop Thumbnails WordPress plugin (versions before 1.10.0 ) is vulnerable to an authorization flaw because it fails to perform object-level authorization when reading and re-cropping media attachments. This allows any authenticated user with upload capabilities (such as the Author role) to acc...

CVE-2026-110041 Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints

The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability the Author role by default to read the metadata of, and overwrite the generated thumbnail files...

WordPress Crop Thumbnails plugin < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite vulnerability

Author+ Arbitrary Attachment Read and Overwrite vulnerability discovered by Pedro Pinho in WordPress Plugin Crop-Thumbnails versions 1.10.0...