Cross-Site Scripting Vulnerability in Manual Image Crop Plugin for WordPress
CVE-2026-15384
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 16 August 2026
Badges
What is CVE-2026-15384?
The Manual Image Crop plugin for WordPress prior to version 1.15 lacks proper capability checks and nonce verification for its AJAX actions. This oversight allows logged-in users, even those with subscriber-level access, to manipulate attachment images. An attacker can exploit this weakness to change the intermediate size of any attachment image, including its thumbnail, and tamper with the associated metadata. This introduces a cross-user integrity issue, as users can affect content they do not own, leading to potential defacement in the Media Library. Additionally, the absence of a nonce exposes the plugin to CSRF attacks, further compromising site security.
Affected Version(s)
Manual Image Crop 0 < 1.15
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.