WordSec
WordSec

ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More <= 6.3.2 - Missing Authorization

2026-07-01 00:00
Denver Jackson

Strategic Overview

Status
Patched in 6.3.3
Affected PluginThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More
Affected Version<= 6.3.2
CVSS4.3Medium
CVECVE-2026-57720
View all ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More vulnerabilities

Vulnerability Overview

The ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.3.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Technical Analysis

REMEDIATION: Update to version 6.3.3, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

External References

https://www.cve.org/CVERecord?id=CVE-2026-57720https://www.wordfence.com/threat-intel/vulnerabilities/id/ab2b2a9d-fadd-4056-bb66-f1a070eb0361

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C

ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More <= 6.3.2 - Missing Authorization (CVE-2026-57720)