CVE-2026-110041

The Crop Thumbnails WordPress plugin (versions before 1.10.0 ) is vulnerable to an authorization flaw because it fails to perform object-level authorization when reading and re-cropping media attachments. This allows any authenticated user with upload capabilities (such as the Author role) to acc...

WordPress Crop Thumbnails plugin < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite vulnerability

Author+ Arbitrary Attachment Read and Overwrite vulnerability discovered by Pedro Pinho in WordPress Plugin Crop-Thumbnails versions 1.10.0...

CVE-2026-110041 Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints

The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability the Author role by default to read the metadata of, and overwrite the generated thumbnail files...