CVE-2026-13432: 
WordPress vulnerability analysis and mitigation

CVE-2026-13432 is a Missing Authorization (CWE-862) vulnerability in the ThumbPress WordPress plugin that allows authenticated users with subscriber-level access or higher to deactivate the plugin via an unprotected AJAX action. It affects all ThumbPress versions before 6.2.2 and was publicly disclosed on June 29, 2026, with NVD publication on July 20, 2026. The vulnerability was discovered and reported by researcher Umut Can Yurdayardım. It carries a CVSS score of 5.4 (Medium) (WPScan, GitHub Advisory).

The root cause is a missing capability check (CWE-862 / OWASP A5: Broken Access Control) on the pl-plugin-deactivation AJAX action registered by ThumbPress. Any authenticated WordPress user — including those with the lowest default role (Subscriber) — can send a POST request to wp-admin/admin-ajax.php with action=pl-plugin-deactivation without supplying a nonce or any elevated privilege, and the server will deactivate the ThumbPress plugin. No special configuration or prior exploitation is required beyond having a valid WordPress session (WPScan).

Successful exploitation disrupts the site's image-handling and thumbnail-management functionality by deactivating the ThumbPress plugin, resulting in an availability impact for features dependent on it. While the vulnerability does not directly expose sensitive data or allow code execution, it can be leveraged by any registered user — including low-privilege accounts — to sabotage site functionality, potentially as part of a broader attack chain. The integrity and confidentiality impacts are minimal, but the availability impact on image-related features is immediate and requires administrator intervention to restore (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running ThumbPress versions prior to 6.2.2 (e.g., by checking plugin metadata at https://victim.example/wp-content/plugins/image-sizes/readme.txt or using WPScan).
2. Obtain authenticated session: Register or log in as any WordPress user with at least Subscriber-level access on the target site.
3. Capture session cookie: Retrieve the WordPress authentication cookie (e.g., wordpress_logged_in_*) from the browser or via a login request.
4. Send malicious AJAX request: Issue a POST request to the target's wp-admin/admin-ajax.php endpoint with the deactivation action and the session cookie:

   curl -s -b "<session_cookie>" -X POST "https://victim.example/wp-admin/admin-ajax.php" \
     --data "action=pl-plugin-deactivation"

5. Confirm deactivation: A successful response returns {"status":1,"message":"Plugin deactivated"} (HTTP 200), and ThumbPress is now inactive, disrupting image-handling functionality on the site (WPScan).

• Network: Unexpected POST requests to /wp-admin/admin-ajax.php with the body parameter action=pl-plugin-deactivation from non-administrator user sessions.
• Logs: WordPress access logs showing HTTP 200 responses to admin-ajax.php with the pl-plugin-deactivation action from low-privilege user accounts; WordPress activity logs (if enabled) recording plugin deactivation events not initiated by an administrator.
• Application State: ThumbPress plugin appearing as inactive in the WordPress Plugins dashboard without a corresponding administrator action; image-handling or thumbnail features suddenly broken on the frontend.

Update ThumbPress to version 6.2.2 or later, which introduces the required capability check on the affected AJAX action. As a temporary workaround, site administrators can restrict user registration or remove untrusted subscriber-level accounts until the patch is applied. Additionally, a Web Application Firewall (WAF) rule blocking POST requests to admin-ajax.php with action=pl-plugin-deactivation from non-administrator sessions can reduce exposure (WPScan, GitHub Advisory).