CVE-2026-110041

LowCVSS 3.8/10Last modified Nov 12, 2026

Description

The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1100424.9The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configurat CVE-2026-1100438.8Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1100448.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-1100457.3Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att CVE-2026-1100466.5Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-1100478.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1100488.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1100497.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-110055.3Out of bounds read in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pr CVE-2026-1100508.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1100516.5Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-1100527.5Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.