AJAX Thumbnail Rebuild

AJAX Thumbnail Rebuild has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for AJAX Thumbnail Rebuild has a vendor fix available, so running the current release closes it.

All of these findings were reported by Justiice. AJAX Thumbnail Rebuild is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all AJAX Thumbnail Rebuild vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2022-47604

AJAX Thumbnail Rebuild <= 1.13 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Plugin Profile
Latestv2.2.1

AJAX Thumbnail Rebuild

junkcoder

Author

junkcoder

4.8(90)
96/100
Last Updated
2026-09-12 (1d ago)
Active Installs
30,000+
Downloads
889,601
Requires WP
5.7+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2009-10-12 (17y ago)

AJAX Thumbnail Rebuild recreates the resized copies WordPress makes of every image in your media library. It does them one image at a time, so a library of any size gets through without running into the script timeout that stops the plugins which rebuild everything in a single request. You need this whenever the sizes change: a new theme with different dimensions, a plugin that registers a size of its own, or a size you have edited yourself. WordPress applies those to images uploaded afterwards and leaves everything already in the library at its old dimensions. Rebuilding fills the gap. On its screen under Tools you can: Pick which of the registered sizes to rebuild, so a single changed size does not mean redoing all of them. Rebuild only the images used as a featured image – which covers WooCommerce product images and product galleries – or only the file names matching a pattern, e.g. banner-*.jpg. Watch it run: a progress bar, the image being worked on, a Stop button, and a list of anything it had to skip. See every image size registered on the site with its dimensions and crop setting. Clean up the resized files left behind by sizes that no longer exist. You can also work on one image at a time without leaving the media library: a row action rebuilds or optimises a single image, a bulk action hands a selection to the plugin’s screen, and the attachment details panel – wherever it opens – rebuilds, optimises, or replaces the file. A replaced image keeps its id, title and address, so every post and product already pointing at it shows the new picture. Beyond rebuilding, each of these is off until you turn it on: Uploads. How hard WordPress compresses the copies it writes, and how large an image may stay before it is scaled down. Optimising. Makes files smaller without resizing them, using the optimisers installed on the server – jpegoptim, optipng, gifsicle, and pngquant where lossy PNG is allowed. Where a host has none, TinyPNG or ShortPixel can do the same job over their API. A file is replaced only when the new one is genuinely smaller. AVIF and WebP copies. Written next to every image WordPress generates and served through a picture element, AVIF first, WebP after it, the original as the fallback – which works behind a page cache. Background processing. Optimising and the copies are the slow half of an upload. Queue them instead, and the upload finishes as soon as the sizes are written – on Action Scheduler where the site has it, on WP-Cron where it does not. Image proxy. Front end image URLs can be served through wsrv.nl, which resizes and re-encodes on the fly and serves the result from a CDN. Your own files are never touched. Sizes on demand. An upload keeps only its own file, and each size is cut the first time something asks for it. This plugin requires JavaScript to be enabled. Contributions are welcome at Github

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C