CVE-2026-110041
Last modified
CVE-2026-110041 is a low-severity vulnerability rated 3.8/10 on the CVSS scale. The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Crop Thumbnails | < 1.10.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-110041?
How severe is CVE-2026-110041?
How do I fix CVE-2026-110041?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-110034The Salon Booking System WordPress plugin before 10.31.11 do…3.7
- CVE-2026-110035The Salon Booking System WordPress plugin before 10.31.11 d…4.3
- CVE-2026-110036A flaw was found in device-mapper-persistent-data. A local a…3.3
- CVE-2026-110037Adobe Experience Manager is affected by a stored Cross-Site …5.4
- CVE-2026-110039The Smush WordPress plugin before 4.3.4 does not restrict c…2.7
- CVE-2026-11004Out of bounds read in ANGLE in Google Chrome prior to 149.0.…5.3
- CVE-2026-110042The Payment Forms for Paystack WordPress plugin before 4.0.6…4.9
- CVE-2026-110043Heap-based buffer overflow in Microsoft Office Outlook allow…8.8
- CVE-2026-110044Deserialization of untrusted data in Microsoft Office ShareP…8.8
- CVE-2026-110045Improper neutralization of input during web page generation …7.3
- CVE-2026-110046Off-by-one error in Microsoft Office Word allows an unauthor…6.5
- CVE-2026-110047Use after free in Microsoft Office Word allows an unauthoriz…8.8
Are you affected by CVE-2026-110041?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST