{"id":"CVE-2026-110041","kind":"vulnerability","aliases":["CVE-2026-110041"],"related":[],"title":"Crop Thumbnails WordPress plugin lets authors overwrite other users' media","description":"The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.","summary":"The Crop Thumbnails WordPress plugin before 1.10.0 does not check object ownership when reading and re-cropping media attachments. Any logged-in user with upload rights, such as an Author, can read metadata of other users' attachments and overwrite their thumbnails and stored metadata.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crop-thumbnails","package","self-hosted","wordpress"],"not_affected_if":["no-untrusted-authors","plugin-1.10.0-or-later","plugin-not-installed"],"how_to_check":"- Check the installed Crop Thumbnails plugin version in the WordPress admin Plugins screen; versions before `1.10.0` are affected.\n- Confirm whether any untrusted users hold the Author role or higher on the site.","fix":"- Crop Thumbnails `1.10.0`","status":"open","published_at":"2026-11-12T06:17:10+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","triaged_at":"2026-11-12T06:38:06+00:00","updated_at":"2026-11-12T06:38:06+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-12T06:38:06Z","model":"claude-haiku-5-5","output":{"fix":"- Crop Thumbnails `1.10.0`","reach":"network","title":"Crop Thumbnails WordPress plugin lets authors overwrite other users' media","impact":"medium","summary":"The Crop Thumbnails WordPress plugin before 1.10.0 does not check object ownership when reading and re-cropping media attachments. Any logged-in user with upload rights, such as an Author, can read metadata of other users' attachments and overwrite their thumbnails and stored metadata.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","crop-thumbnails","self-hosted"],"confidence":0.75,"fix_status":"available","needs_auth":"yes","worst_case":"authors overwrite other users' media thumbnails and metadata","analyst_note":"","how_to_check":"- Check the installed Crop Thumbnails plugin version in the WordPress admin Plugins screen; versions before `1.10.0` are affected.\n- Confirm whether any untrusted users hold the Author role or higher on the site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-1.10.0-or-later","no-untrusted-authors"],"who_is_affected":"Sites running the Crop Thumbnails plugin before 1.10.0 where users with upload capability, such as the default Author role, can access the site. Sites without the plugin or with only trusted administrators and editors are less exposed; the sources do not describe any other configuration requirement.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000742,"input_tokens":4561,"output_tokens":571,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110041':13A,16A '-2026':12A,15A '1.10.0':31B,77C 'allow':93C 'attach':44B,63B,92C,122C 'authent':95C 'author':6A,56B,84C,102C 'belong':123C 'capabl':100C 'check':34B 'crop':1A,18B,26B,42B,72C,90C 'crop-thumbnail':17B 'cve':11A,14A 'default':105C 'file':116C 'generat':114C 'host':23B 'let':5A 'level':83C 'log':47B 'logged-in':46B 'media':10A,43B,91C,121C 'metadata':59B,70B,109C,119C 'object':35B,82C 'object-level':81C 'overwrit':7A,65B,112C 'ownership':36B 'packag':20B 'perform':80C 'plugin':4A,29B,75C 're':41B,89C 're-crop':40B,88C 'read':38B,58B,86C,107C 'right':52B 'role':103C 'self':22B 'self-host':21B 'store':69B,118C 'thumbnail':2A,19B,27B,67B,73C,115C 'upload':51B,99C 'user':9A,49B,62B,96C,126C 'wordpress':3A,24B,28B,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Crop Thumbnails plugin before 1.10.0 where users with upload capability, such as the default Author role, can access the site. Sites without the plugin or with only trusted administrators and editors are less exposed; the sources do not describe any other configuration requirement.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cropthumbnails","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-110041':13A,16A '-2026':12A,15A 'author':6A 'crop':1A 'cve':11A,14A 'let':5A 'media':10A 'overwrit':7A 'plugin':4A 'thumbnail':2A 'user':9A 'wordpress':3A","search_b":"'1.10.0':31B 'attach':44B,63B 'author':56B 'check':34B 'crop':18B,26B,42B 'crop-thumbnail':17B 'host':23B 'log':47B 'logged-in':46B 'media':43B 'metadata':59B,70B 'object':35B 'overwrit':65B 'ownership':36B 'packag':20B 'plugin':29B 're':41B 're-crop':40B 'read':38B,58B 'right':52B 'self':22B 'self-host':21B 'store':69B 'thumbnail':19B,27B,67B 'upload':51B 'user':49B,62B 'wordpress':24B,28B","search_c":"'1.10.0':77C 'allow':93C 'attach':92C,122C 'authent':95C 'author':84C,102C 'belong':123C 'capabl':100C 'crop':72C,90C 'default':105C 'file':116C 'generat':114C 'level':83C 'media':91C,121C 'metadata':109C,119C 'object':82C 'object-level':81C 'overwrit':112C 'perform':80C 'plugin':75C 're':89C 're-crop':88C 'read':86C,107C 'role':103C 'store':118C 'thumbnail':73C,115C 'upload':99C 'user':96C,126C 'wordpress':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110041","severity":null,"published_at":"2026-11-12T06:17:10+00:00","modified_at":"2026-11-12T06:17:10+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","fetched_at":"2026-11-12T06:36:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}