Description

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-deactivation AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the ThumbPress plugin on the affected site by sending a crafted POST request to admin-ajax.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-22T08:16:40.387Z",
  "pubdate": "2026-09-22T08:16:40.387Z",
  "executiveSummary": "The ThumbPress WordPress plugin, in versions up to and including 6.2.1, contains an improper access control vulnerability within its deactivation survey mechanism.\nThe flaw originates from the wp_ajax_pl-plugin-deactivation AJAX action, which fails to implement mandatory capability checks or nonce verification.\nThis vulnerability allows any authenticated user, including those with minimal Subscriber-level privileges, to force the deactivation of the ThumbPress plugin.\nThe impact involves an unauthorized disruption of service, as the plugin can be programmatically disabled by an attacker without administrative oversight.\nWhile the vulnerability does not allow for remote code execution, it facilitates an integrity and availability issue that can disrupt site functionality reliant on ThumbPress image optimization and management features.\nThe attack vector is restricted to authenticated users, meaning attackers must possess at least a registered account on the target WordPress installation to execute the malicious request.",
  "technicalDetails": "The vulnerability is situated within the send_deactivation_survey() function, which is designed to handle plugin deactivation telemetry via an AJAX request. This function is hooked into the WordPress admin-ajax.php endpoint using the action hook 'wp_ajax_pl-plugin-deactivation'.\nThe root cause of this security flaw is the total absence of security-critical validation checks within the handling function. Specifically, the code fails to perform current_user_can() checks to ensure the requesting user possesses administrative privileges (such as 'manage_options') before executing the deactivation logic.\nFurthermore, the implementation lacks a cryptographic nonce check, which is the standard WordPress security mechanism intended to prevent Cross-Site Request Forgery (CSRF) and unauthorized AJAX requests. Because there is no token validation, the server-side logic trusts any incoming POST request directed to the 'pl-plugin-deactivation' action.\nThe attack flow proceeds as follows: An authenticated user (e.g., a Subscriber) crafts a POST request targeting /wp-admin/admin-ajax.php. The request must include the 'action' parameter set to 'pl-plugin-deactivation'.\nUpon receiving this request, the WordPress AJAX handler executes the send_deactivation_survey() function. Since the function lacks authorization checks, it proceeds to perform the underlying deactivation routine associated with the ThumbPress plugin.\nBecause the function is designed to handle plugin deactivation, the execution of this routine effectively disables the plugin's hooks and functionality across the site.\nThe impact is a denial-of-service condition regarding the plugin's features. An attacker can persistently disable the plugin, forcing site administrators to manually re-activate it. In environments where image processing or automated optimization is mission-critical, this unauthorized deactivation can lead to site-wide functional degradation.\nThis vulnerability is strictly an access control failure. It leverages the legitimate AJAX infrastructure provided by WordPress but exploits the lack of restrictive checks within the plugin's custom code, bypassing the expectation that only administrative users should be able to alter the status of active plugins."
}