UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-110041
The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-11-12T07:51:00.177133+00:00
- Cve id
- CVE-2026-110041
- First seen by Signal
- 2026-11-12T07:52:20+00:00
- Retrieved at
- 2026-11-12T07:52:20+00:00
- Published at
- 2026-11-12T06:17:10.863
- Last modified
- 2026-11-12T06:17:10.863
Explore deeper with Ninja Signal's threat intelligence graph