CVE-2026-7622 in ThumbPress Plugin
Summary
by MITRE • 09/22/2026
The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-deactivation AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the ThumbPress plugin on the affected site by sending a crafted POST request to admin-ajax.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in the ThumbPress WordPress plugin affects versions up to 6.2.1 and represents a critical failure in server-side authorization controls within the application's AJAX handling logic. Specifically, the flaw resides in the send_deactivation_survey function which is exposed via the wp_ajax_pl-plugin-deactivation action hook. This architectural oversight allows for unauthorized administrative actions because the code fails to implement essential security mechanisms required by WordPress standards and general web application security best practices. The absence of these checks creates a direct pathway for attackers who have obtained valid authentication credentials with at least Subscriber-level privileges to execute privileged operations that should be restricted to higher-tier roles such as Administrators or Editors.
From a technical perspective, the core issue is twofold: missing capability verification and absent nonce validation. In WordPress development, any function triggered by an AJAX request must verify that the user initiating the request possesses the necessary capabilities defined in the global $current_user object before executing sensitive logic. Furthermore, nonces are cryptographic tokens used to prevent Cross-Site Request Forgery attacks; their absence means there is no mechanism to ensure the request originated from a legitimate form submission on the site itself rather than an external malicious script. The combination of these missing checks effectively neutralizes two primary layers of defense against unauthorized state-changing actions.
The operational impact of this vulnerability allows authenticated attackers with minimal privileges, specifically Subscriber level and above, to deactivate the ThumbPress plugin without authorization. While deactivating a single plugin might seem like a low-severity issue in isolation, it can lead to significant service disruption if that plugin is integral to site functionality or security monitoring. Additionally, such unauthorized actions contribute to an environment where attackers can manipulate application state, potentially masking their presence by disabling security plugins or causing denial of service through repeated deactivation and reactivation cycles which may trigger resource-intensive operations depending on the plugin's implementation details.
This vulnerability aligns with CWE-862 Missing Authorization, as the software does not properly enforce access control policies for specific resources or functions. It also maps to ATT&CK technique T1499 Endpoint Denial of Service if the deactivation causes service interruption, and potentially T1078 Valid Accounts if attackers leverage compromised low-level credentials to perform high-impact actions. The lack of nonce verification further relates to CWE-352 Cross-Site Request Forgery since the application accepts state-changing requests without verifying their origin integrity.
To mitigate this vulnerability, site administrators should immediately update the ThumbPress plugin to version 6.2.2 or later where these checks have been implemented. For environments unable to patch immediately due to compatibility constraints, temporary mitigation involves restricting user roles that can access wp-admin and ensuring strict adherence to principle of least privilege across all user accounts. Additionally, implementing a Web Application Firewall with rulesets designed to detect anomalous AJAX patterns may provide an additional layer of defense against exploitation attempts until the software is fully patched.