CVE-2026-110041— Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints

Quick assessment

Affected

Unknown Crop Thumbnails

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 1.10.0 之前，Crop Thumbnails WordPress 插件在读取和重新裁剪媒体附件时未执行对象级别的授权检查。这导致任何具备上传权限的已认证用户（默认情况下为“作者”角色）能够读取其他用户媒体附件的元数据，并覆盖其生成的缩略图文件及存储的元数据。

AI Predicted 6.5 Difficulty: Easy Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1565 · Data Manipulation T1068 · Exploitation for Privilege Escalation

Updated Nov 12, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints

Source: CVE Program / CVE List V5

Vulnerability Description

The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Crop Thumbnails	0 ~ 1.10.0	-

II. Public POCs for CVE-2026-110041

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-110041

请登录查看更多情报信息。

Other References for CVE-2026-110041 (1)

https://wpscan.com/vulnerability/f79fa2e0-ebba-4075-84d9-b5fadfbd6ca4/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-110041

Same Patch Batch · Unknown · 2026-11-12 · 21 CVEs total

CVE-2026-121498		Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR
CVE-2026-110072		Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attr
CVE-2026-106027		Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion v
CVE-2026-110959		Descope < 1.2.0 - Unauthenticated Account Takeover
CVE-2026-119039		Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detecti
CVE-2026-118421		WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter
CVE-2026-118531		Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update
CVE-2026-123044		ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure
CVE-2026-119040		Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification
CVE-2026-122003		Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF
CVE-2026-76792		User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP L
CVE-2026-123092		WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Actio
CVE-2026-124652		Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR
CVE-2026-124653		Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure
CVE-2026-124647		TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie
CVE-2026-124648		TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key
CVE-2026-124815		Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions
CVE-2026-124814		Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 't
CVE-2026-124817		Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification
CVE-2026-124665		Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure v

IV. Related Vulnerabilities

Same vendor: Unknown