---
id: "CVE-2026-110041"
page: "https://infrastack.ai/live/CVE-2026-110041"
kind: "vulnerability"
aliases: ["CVE-2026-110041"]
title: "Crop Thumbnails WordPress plugin lets authors overwrite other users' media"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["crop-thumbnails", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-untrusted-authors", "plugin-1.10.0-or-later", "plugin-not-installed"]
published_at: "2026-11-12T06:17:10+00:00"
first_seen_at: "2026-11-12T06:36:51+00:00"
updated_at: "2026-11-12T06:38:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110041", "first_seen_at": "2026-11-12T06:36:51+00:00"}]
exploit_sources: []
---

# Crop Thumbnails WordPress plugin lets authors overwrite other users' media

Link for people: https://infrastack.ai/live/CVE-2026-110041 (this .md is for agents)

The Crop Thumbnails WordPress plugin before 1.10.0 does not check object ownership when reading and re-cropping media attachments. Any logged-in user with upload rights, such as an Author, can read metadata of other users' attachments and overwrite their thumbnails and stored metadata.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Crop Thumbnails plugin version in the WordPress admin Plugins screen; versions before `1.10.0` are affected.
- Confirm whether any untrusted users hold the Author role or higher on the site.

## Fix

- Crop Thumbnails `1.10.0`

## Timeline

- 2026-11-12T06:36:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110041

## From the sources

The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_