SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-15384

MEDIUM · CVSS 5.7 EPSS 0.11%

Source: NVD + CISA KEV + EPSS · Published 2026-08-16 · Last synced 2026-09-15

CyberRota Analysis

AI-Generated

The Manual Image Crop plugin for WordPress versions prior to 1.15 is vulnerable due to a lack of capability checks and nonce verification on its AJAX actions, allowing authenticated users, including those with subscriber-level access, to manipulate any attachment's intermediate-size images and metadata. This poses a significant risk of cross-user integrity issues and potential defacement within the Media Library. WordPress administrators and site owners using this plugin should prioritize updating to mitigate these vulnerabilities.

CVE
CVE-2026-15384
Severity
MEDIUM
CVSS
5.7
EPSS
0.11%
WordPress

Original NVD Description

The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.