CVE-2026-110041
Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.
| Vendor | unknown |
| Product | crop thumbnails |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown crop thumbnails
Be the first to know when new unknown vulnerabilities affecting unknown crop thumbnails are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Crop Thumbnails
0 < 1.10.0
References
Credits
Pedro Pinho WPScan