ThumbPress <= 6.9.1 - Authenticated (Contributor+) PHP Object Injection via Post Content and Post Meta
- ID
- WPSEC-2026-1326
- Plugin
- ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More (image-sizes)
- Affected
- from 6.3.1 before 6.10.0
- Remediation
- Update to 6.10.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- ThumbPress on WPSec AttackSurface
- Fix released
- Published
Description
The ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More plugin for WordPress is vulnerable to PHP Object Injection via post content and post meta in all versions from 6.3.1 up to, and including, 6.9.1. This is due to the image-address update that runs after an image is converted, regenerated or replaced passing stored post content and post meta values to maybe_unserialize() without restricting the allowed classes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP object by storing serialized data that references an existing image in their own post content or custom fields. The object is instantiated when an administrator converts, regenerates or replaces that image. No known POP chain is present in the vulnerable software, so there is no direct impact. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-1326/
- https://plugins.svn.wordpress.org/image-sizes/tags/6.10.0/
- https://wordpress.org/plugins/image-sizes/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS