CVE-2026-7622CWE-862broken-access-control

CVE-2026-7622

Medium · published September 22, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
27.9
In the wild
Unconfirmed
What it is

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-deactivation AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the ThumbPress plugin on the affected site by sending a crafted POST request to admin-ajax.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-22T12:16Z
References (6)
https://plugins.trac.wordpress.org/browser/image-sizes/tags/5.8.37/vendor/pluggable/marketing/src/Deactivator.php#L175 · [email protected]https://plugins.trac.wordpress.org/browser/image-sizes/tags/5.8.37/vendor/pluggable/marketing/src/Deactivator.php#L58 · [email protected]https://plugins.trac.wordpress.org/browser/image-sizes/trunk/vendor/pluggable/marketing/src/Deactivator.php#L175 · [email protected]https://plugins.trac.wordpress.org/browser/image-sizes/trunk/vendor/pluggable/marketing/src/Deactivator.php#L58 · [email protected]https://plugins.trac.wordpress.org/changeset/3560270 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f998fd-eb15-442d-8034-af820601fe4a?source=cve · [email protected]
EPSS history
Timeline
  • 23 SEP 03:48Z
    EPSS moved — → 0%
    epss
  • 22 SEP 07:41Z
    ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
    cvelistv5