CVE-2026-57720: ThumbPress Auth Bypass Vulnerability

CVE-2026-57720 Overview

CVE-2026-57720 is a Missing Authorization vulnerability [CWE-862] in the Codexpert Inc ThumbPress WordPress plugin. The flaw affects ThumbPress versions up to and including 6.3.2. The plugin fails to enforce proper access control checks, allowing authenticated users with low privileges to invoke functionality intended for higher-privileged roles.

The vulnerability requires network access and low privileges, with no user interaction needed. Successful exploitation impacts availability but does not directly compromise confidentiality or integrity.

Critical Impact
Authenticated attackers with minimal privileges can bypass access control checks in ThumbPress and trigger plugin actions that affect availability of site resources.

Affected Products

Codexpert Inc ThumbPress plugin for WordPress
ThumbPress versions from n/a through 6.3.2
WordPress sites using the image-sizes plugin package

Discovery Timeline

2026-07-01 - CVE-2026-57720 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-57720

Vulnerability Analysis

The vulnerability stems from broken access control in the ThumbPress WordPress plugin. ThumbPress exposes plugin actions that should be restricted to administrators or other privileged roles. The plugin does not verify user capabilities or nonces on protected endpoints. As a result, any authenticated user, including low-privileged subscribers, can invoke restricted functionality.

Missing Authorization [CWE-862] occurs when an application fails to check whether the acting user is authorized to perform a requested operation. In ThumbPress, this manifests as incorrectly configured access control on plugin handlers. The attack surface is reachable over the network through standard WordPress request handling.

Exploitation impacts availability of the WordPress site. An attacker can trigger plugin operations that disrupt normal function, such as manipulating image processing tasks handled by the plugin. Confidentiality and integrity are not directly affected based on the CVSS metrics.

Root Cause

The root cause is the absence of capability checks on plugin request handlers. ThumbPress registers endpoints without validating the caller's role using current_user_can() or an equivalent authorization mechanism. Any authenticated request reaches sensitive code paths.

Attack Vector

An attacker with a valid low-privileged WordPress account sends crafted HTTP requests to the vulnerable ThumbPress endpoints. Because the plugin does not enforce authorization, the request executes the protected action. No user interaction is required. See the Patchstack WordPress Vulnerability Report for advisory details.

Detection Methods for CVE-2026-57720

Indicators of Compromise

Unexpected requests to ThumbPress plugin endpoints originating from non-administrator accounts
WordPress access logs showing repeated POST or GET requests to image-sizes plugin actions from subscriber-level sessions
Anomalous changes in image processing behavior or availability degradation on WordPress sites running ThumbPress

Detection Strategies

Review WordPress audit logs for plugin action invocations by users lacking administrator or editor roles
Correlate authenticated session activity with plugin endpoint access patterns
Alert on ThumbPress action requests where the acting user's role does not match expected administrator scope

Monitoring Recommendations

Enable a WordPress security audit plugin to capture role-scoped action telemetry
Forward WordPress and web server logs to a centralized log platform for correlation
Monitor plugin version inventory and flag installations of ThumbPress at or below version 6.3.2

How to Mitigate CVE-2026-57720

Immediate Actions Required

Update the ThumbPress plugin to a version later than 6.3.2 once released by Codexpert Inc
Audit existing WordPress user accounts and remove unused low-privileged accounts that could be leveraged for exploitation
Restrict registration on WordPress sites where subscriber-level self-registration is enabled

Patch Information

At the time of publication, refer to the Patchstack WordPress Vulnerability Report for the latest fixed version guidance. Apply the vendor-supplied update as soon as it becomes available through the WordPress plugin repository.

Workarounds

Deactivate the ThumbPress plugin until a fixed version is installed
Deploy a web application firewall (WAF) rule to block requests to ThumbPress action endpoints from non-administrator sessions
Enforce strong authentication and multi-factor authentication for all WordPress users to reduce the risk of attacker-controlled low-privileged accounts

bash

# Configuration example: disable ThumbPress via WP-CLI until patched
wp plugin deactivate image-sizes
wp plugin status image-sizes