CVE-2026-110041

The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability the Author role by default to read the metadata of, and overwrite the generated thumbnail files...