Object-Level Authorization Flaw in Crop Thumbnails Plugin by WordPress
CVE-2026-110041
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-110041?
The Crop Thumbnails Plugin for WordPress, prior to version 1.10.0, contains an improper access control vulnerability that permits authenticated users, notably those with the Author role, to manipulate media attachments that do not belong to them. This flaw allows such users to read and overwrite the metadata and thumbnail files of other users' media attachments, potentially leading to unauthorized access and privacy breaches.
Affected Version(s)
Crop Thumbnails 0 < 1.10.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.