CVE-2026-7622: ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the senddeactivationsurvey() function registered via the wpajaxpl-plugin-deactivation AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the ThumbPress plugin on the affected site by sending a crafted POST request to admin-ajax.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access on a site running an affected ThumbPress version. No user interaction is required.
What action can an attacker perform?
The attacker can send a crafted POST request to WordPress admin-ajax using the wp_ajax_pl-plugin-deactivation action and deactivate the ThumbPress plugin.
What makes this possible?
The affected AJAX handler lacks capability checks and nonce verification. As a result, it does not adequately verify that the authenticated user is authorized to deactivate the plugin.
How can administrators determine whether they are affected?
Check whether ThumbPress is installed and running a version up to and including 6.2.1. Sites where untrusted or low-privileged users have Subscriber-level or higher accounts are exposed to exploitation by those users.