CVE-2026-15384
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Manual Image Crop WordPress plugin before version 1.15 lacks capability checks and nonce verification on the authenticated AJAX action for cropping images; any logged-in user can pass. A subscriber can supply an arbitrary attachment ID and overwrite its intermediate-size image (e.g., thumbnail) and mutate its metadata, regardless of ownership. This is a cross-user integrity/defacement issue. The action also has no nonce, making it vulnerable to CSRF.
Risk Assessment
The risk includes unauthorized modification or corruption of images and metadata in the Media Library, leading to defacement and loss of content integrity.
Recommendation
Update the plugin to version 1.15 or later and add proper capability checks and nonce verification to the AJAX action.
Original NVD description (English source)
The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.