CVE-2026-110041: Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints

Q: Which users can exploit this issue in a typical WordPress installation?

Any authenticated user with the upload capability can exploit it. In the default WordPress role configuration, this includes Authors.

Q: What access does an attacker need before they can abuse the affected endpoints?

The attacker must be authenticated and have the upload capability. No higher administrative privilege is indicated.

Q: What can an attacker do to media owned by other users?

They can read attachment metadata and re-crop attachments belonging to other users, overwriting generated thumbnail files and the stored metadata for those attachments.

Q: Which plugin versions are affected?

Crop Thumbnails versions before 1.10.0 are affected.

Published Nov 12, 2026

Updated

The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue in a typical WordPress installation?

Any authenticated user with the upload capability can exploit it. In the default WordPress role configuration, this includes Authors.

What access does an attacker need before they can abuse the affected endpoints?

The attacker must be authenticated and have the upload capability. No higher administrative privilege is indicated.

What can an attacker do to media owned by other users?

They can read attachment metadata and re-crop attachments belonging to other users, overwriting generated thumbnail files and the stored metadata for those attachments.

Which plugin versions are affected?

Crop Thumbnails versions before 1.10.0 are affected.

CVE-2026-110041: Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints

Event History

Frequently Asked Questions

Which users can exploit this issue in a typical WordPress installation?

What access does an attacker need before they can abuse the affected endpoints?

What can an attacker do to media owned by other users?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue in a typical WordPress installation?

What access does an attacker need before they can abuse the affected endpoints?

What can an attacker do to media owned by other users?

Which plugin versions are affected?