Description

The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-16T06:16:50.740Z",
  "pubdate": "2026-08-16T06:16:50.740Z",
  "executiveSummary": "The Manual Image Crop WordPress plugin prior to version 1.15 suffers from an authorization bypass vulnerability affecting the authenticated AJAX action used for cropping attachment images. The lack of proper capability checks and nonce verification introduces a cross-user integrity and defacement risk within the WordPress Media Library.\nAn authenticated attacker with low-level privileges, such as a subscriber, can exploit this flaw to manipulate arbitrary media attachments regardless of ownership. By supplying an arbitrary attachment ID to the vulnerable endpoint, an unauthorized user can overwrite generated intermediate-size images, such as thumbnails, and corrupt associated metadata.\nAdditionally, the absence of cryptographic nonce protection exposes the AJAX action to Cross-Site Request Forgery (CSRF) vectors. This allows malicious actors to trick authenticated administrators or users into executing unintended image manipulation actions via crafted external web requests.\nThe risk implication is unauthorized data modification and content defacement across the target WordPress installation's media assets. Exploitation requires the attacker to possess an authenticated session on the platform, typically at the subscriber tier or above, or to successfully leverage CSRF against a higher-privileged active session.",
  "technicalDetails": "The vulnerability resides in the authenticated AJAX action handler provided by the Manual Image Crop WordPress plugin, which fails to validate user capabilities and lacks anti-CSRF nonce tokens before processing image crop requests.\nThe vulnerable component is the AJAX endpoint responsible for handling attachment image cropping operations. Affected versions include all instances of the Manual Image Crop plugin prior to version 1.15.\nAuthentication and privilege requirements are minimal; the endpoint's execution guard is restricted solely to verifying whether a user is logged into the WordPress platform. Consequently, any authenticated user, including restricted roles like subscribers, can access and trigger the AJAX functionality.\nThe root cause of the vulnerability stems from missing authorization logic. The codebase fails to implement current_user_can() checks to verify if the requesting user possesses administrative rights or ownership over the specific media attachment targeted for modification.\nThe attack flow proceeds as follows: 1) An attacker authenticates to the WordPress site as a low-level user (subscriber). 2) The attacker crafts an HTTP POST request targeting the plugin's vulnerable AJAX action. 3) The payload includes an arbitrary attachment ID belonging to another user or a protected system asset, along with malicious crop parameters. 4) Because the backend only checks for a valid session and omits capability checks and nonce verification, the application processes the request. 5) The server overwrites the designated intermediate-size image (e.g., thumbnail) and mutates the stored metadata in the database.\nPost-exploitation impact includes persistent content defacement of media library assets, potential disruption of site layouts relying on specific image sizes, and data integrity compromise of attachment metadata. Furthermore, due to the complete absence of nonce validation, third-party sites can launch CSRF attacks against administrative browsers to execute unauthorized image crops autonomously."
}