CVE-2026-15384: Manual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR
The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15384?
CVE-2026-15384 has a risk score of 48, indicating a medium threat level.
How do I fix CVE-2026-15384?
To fix CVE-2026-15384, update the Manual Image Crop WordPress plugin to version 1.15 or later.
What type of vulnerability is CVE-2026-15384?
CVE-2026-15384 is identified as an IDOR vulnerability, allowing unauthorized image overwrites.
Who is affected by CVE-2026-15384?
CVE-2026-15384 affects websites using the Manual Image Crop plugin version before 1.15 with authenticated users having subscriber roles.
What can attackers do with CVE-2026-15384?
Attackers can exploit CVE-2026-15384 to overwrite arbitrary image attachments by supplying their IDs.