ThumbPress Plugin Vulnerability (CVE-2026-7622)

1 month ago

On this page

Security Alert Summary

The ThumbPress plugin for WordPress contains an authorization bypass that allows authenticated users with Subscriber-level access and above to deactivate the plugin. The issue exists because the send_deactivation_survey() function, registered on the wp_ajax_pl-plugin-deactivation action, lacks capability checks and nonce verification. An attacker can trigger plugin deactivation by sending a crafted POST request to admin-ajax.php.

CVE Details

CVE ID: CVE-2026-7622
Affected component: ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More
Affected versions: Versions up to and including 6.2.1
Published: September 22, 2026 at 8:16 AM UTC
Last modified: September 22, 2026 at 11:17 AM UTC
CVSS v3.1 base score: 4.3 (MEDIUM)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Authentication requirements: Attacker must be authenticated (Subscriber-level or higher)
Privileges required: Low (PR:L)
User interaction: None (UI:N)
Primary impact: Confidentiality: None; Integrity: Low; Availability: None
Weakness: CWE-862 (Missing Authorization)

Technical Details

The vulnerability is an authorization bypass in the ThumbPress plugin caused by missing capability checks and missing nonce verification in the send_deactivation_survey() function. That function is registered to handle the wp_ajax_pl-plugin-deactivation AJAX action. Because proper authorization and nonce checks are not enforced, an authenticated user with low privileges (Subscriber-level) can invoke the AJAX action via a crafted POST request to admin-ajax.php and trigger the plugin deactivation flow.

The impact is limited to the ability to deactivate the ThumbPress plugin on the affected site. The issue does not claim direct data disclosure, remote code execution, or full site takeover in the provided information; it allows a low-privileged authenticated user to change the plugin activation state by exploiting missing checks in the specified AJAX handler.

How This Could Impact Your Website

Consider a small team managing a WordPress site: the site owner, internal staff with Editor or Author roles, and external contributors or contractors assigned Subscriber-level accounts. An authenticated subscriber or contractor could exploit this issue to deactivate the ThumbPress plugin without higher privileges. If ThumbPress provides image optimization, thumbnail management, or hotlink protections for your site, deactivation could interrupt those services and change how media is processed or served.

Indirect practical consequences may include temporary disruption to media workflows, broken thumbnail displays, or removal of optimizations that affect page load times. Changes to site behavior could also increase the chance of user confusion or targeted social engineering if internal processes change unexpectedly. These are indirect risks and do not imply direct exposure of confidential data based on the provided CVE details.

If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

Update the affected plugin as soon as a patched version is available.
Review and reduce unnecessary user roles, especially limiting Subscriber or Contributor accounts where not needed.
Enforce strong passwords and two-factor authentication for editors and administrators.
Remove unused or unmaintained plugins to reduce attack surface.
Monitor site activity and logs for unusual or unexpected administrative actions, including plugin deactivation events.

If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughi https://freshysites.com/team/nick-paliughi/

Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.