CVE-2026-7622— ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation

一分钟漏洞结论

复制摘要 复制引用

影响对象

codexpert ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More

利用判断

尚无明确在野利用证据，仍需结合暴露面评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-deac

CVE-2026-7622 影响 codexpert ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More。尚无明确在野利用证据，仍需结合暴露面评估。The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in t CVE-2026-7622 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2026-7622

一、 漏洞 CVE-2026-7622 基础信息

受影响产品

二、漏洞 CVE-2026-7622 的公开POC

三、漏洞 CVE-2026-7622 的情报信息

CVE-2026-7622 其他参考 (5)

• 🔗 Deactivator.php in image-sizes/tags/5.8.37/vendor/pluggable/marketing/src – WordPress Plugin Repository 查看完整文章
• 🔗 ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation 查看完整文章
• 🔗 Deactivator.php in image-sizes/tags/5.8.37/vendor/pluggable/marketing/src – WordPress Plugin Repository 查看完整文章
• 🔗 Deactivator.php in image-sizes/trunk/vendor/pluggable/marketing/src – WordPress Plugin Repository
• 🔗 Deactivator.php in image-sizes/trunk/vendor/pluggable/marketing/src – WordPress Plugin Repository 查看完整文章

CVE-2026-7622 其他参考 (1)

• https://plugins.trac.wordpress.org/changeset/3560270

• https://www.cve.org/CVERecord?id=CVE-2026-7622

IV. Related Vulnerabilities

V. Comments for CVE-2026-7622