PT-2026-60283 · WordPress · Thumbpress

CVE-2026-13432 · Published 2026-07-15 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions ThumbPress WordPress plugin versions prior to 6.2.2

Description An issue exists where the plugin fails to perform a capability check on an AJAX action. This allows authenticated users with subscriber-level access or higher to deactivate the plugin, which disrupts the image-handling functionality of the site.

Recommendations Update ThumbPress WordPress plugin to version 6.2.2 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-13432

Affected Products

Thumbpress

References · 4

• 🔥 https://wpscan.com/vulnerability/a408e8f9-4de7-4449-8fca-51ea46e4f433 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-13432 · Security Note
• https://twitter.com/VulmonFeeds/status/2079117618166845725 · Twitter Post
• https://twitter.com/umut_sec/status/2077447605190029383 · Twitter Post