CVE-2026-7622: ThumbPress WordPress Plugin Auth Bypass

CVE-2026-7622 Overview

The ThumbPress plugin for WordPress contains a missing authorization vulnerability affecting all versions up to and including 6.2.1. The flaw resides in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-deactivation AJAX action. The function lacks both capability checks and nonce verification, allowing authenticated users with Subscriber-level access or higher to deactivate the plugin by sending a crafted POST request to admin-ajax.php. The issue is classified under CWE-862: Missing Authorization.

Critical Impact

Any authenticated user, including low-privileged Subscribers, can remotely deactivate the ThumbPress plugin, disabling image optimization functionality on affected WordPress sites.

Affected Products

• ThumbPress plugin for WordPress (also distributed as image-sizes)
• All versions up to and including 6.2.1
• WordPress sites with Subscriber-level or higher registration enabled

Discovery Timeline

• 2026-09-22 - CVE-2026-7622 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-7622

Vulnerability Analysis

The vulnerability stems from an AJAX handler that trusts any authenticated caller. WordPress registers AJAX endpoints through the wp_ajax_{action} hook, which is accessible to any logged-in user regardless of role. Secure implementations must call current_user_can() to enforce capability restrictions and check_ajax_referer() to validate a nonce. The ThumbPress send_deactivation_survey() function in vendor/pluggable/marketing/src/Deactivator.php omits both controls.

An attacker with Subscriber credentials can send a POST request to /wp-admin/admin-ajax.php specifying the pl-plugin-deactivation action. The server processes the request and deactivates the ThumbPress plugin without verifying whether the caller holds the activate_plugins capability. Impact is limited to integrity of the plugin state; the flaw does not directly expose data or enable code execution.

Root Cause

The root cause is missing authorization enforcement in the AJAX endpoint. The deactivation survey handler was designed for administrator-initiated flows but exposed via a hook that any authenticated user can invoke. See the affected code at Deactivator.php Line 175 and Line 58.

Attack Vector

Exploitation requires network access to the WordPress admin AJAX endpoint and valid authentication as a Subscriber or higher. The attacker submits a crafted POST request to admin-ajax.php with the action=pl-plugin-deactivation parameter. No user interaction is required from an administrator. The vulnerability is described in detail in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-7622

Indicators of Compromise

• Unexpected POST requests to /wp-admin/admin-ajax.php containing action=pl-plugin-deactivation originating from non-administrator sessions.
• WordPress activity log entries showing ThumbPress transitioning to a deactivated state without a corresponding administrator session.
• Subscriber or Contributor accounts making requests to plugin management AJAX actions.

Detection Strategies

• Correlate WordPress user role with AJAX action invocations to identify low-privileged accounts triggering plugin state changes.
• Deploy a web application firewall rule that blocks pl-plugin-deactivation requests from sessions lacking the manage_options capability.
• Review the plugin activation history via the active_plugins option in wp_options for unauthorized changes.

Monitoring Recommendations

• Enable audit logging on activate_plugin and deactivate_plugin hooks to capture the acting user and originating request.
• Alert on anomalous request rates to admin-ajax.php from user accounts that historically do not administer plugins.
• Monitor authentication logs for newly registered Subscriber accounts on sites that permit open registration.

How to Mitigate CVE-2026-7622

Immediate Actions Required

• Update the ThumbPress plugin to the version containing Changeset #3560270, which addresses the missing authorization checks.
• Audit WordPress user accounts and remove or downgrade unused Subscriber-level accounts.
• Disable open user registration on sites that do not require it by unchecking Settings → General → Membership.

Patch Information

The vendor addressed the vulnerability in the release following version 6.2.1. The fix adds capability verification and nonce validation to the send_deactivation_survey() function. Review the patch commit in WordPress Changeset #3560270 for implementation details.

Workarounds

• Restrict access to /wp-admin/admin-ajax.php at the web server or WAF layer for requests carrying the pl-plugin-deactivation action.
• Temporarily deactivate the ThumbPress plugin until the patched version can be deployed.
• Enforce two-factor authentication and restrict new account registration to reduce the pool of accounts eligible to exploit the flaw.

# Example nginx rule to block the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "pl-plugin-deactivation") {
        return 403;
    }
}