CVE-2026-110041 · Package
NO FIX YET · SEE WHAT TO DO
The Crop Thumbnails WordPress plugin before 1.10.0 does not check object ownership when reading and re-cropping media attachments. Any logged-in user with upload rights, such as an Author, can read metadata of other users' attachments and overwrite their thumbnails and stored metadata.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Crop Thumbnails plugin before 1.10.0 where users with upload capability, such as the default Author role, can access the site. Sites without the plugin or with only trusted administrators and editors are less exposed; the sources do not describe any other configuration requirement.
Not affected if no-untrusted-authors, plugin-1.10.0-or-later, plugin-not-installed
Who cares crop-thumbnails, self-hosted, wordpress
1.10.0 are affected.1.10.0The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.