# ThumbPress <= 6.9.1 - Authenticated (Contributor+) PHP Object Injection via Post Content and Post Meta

- **ID:** WPSEC-2026-1326
- **Plugin:** ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More (`image-sizes`), https://wordpress.org/plugins/image-sizes/
- **Affected versions:** from 6.3.1 before 6.10.0
- **Fixed in:** 6.10.0 (Update to 6.10.0 or later.)
- **Severity:** High 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-502
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/image-sizes
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1326/

## Description

The ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More plugin for WordPress is vulnerable to PHP Object Injection via post content and post meta in all versions from 6.3.1 up to, and including, 6.9.1. This is due to the image-address update that runs after an image is converted, regenerated or replaced passing stored post content and post meta values to maybe_unserialize() without restricting the allowed classes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP object by storing serialized data that references an existing image in their own post content or custom fields. The object is instantiated when an administrator converts, regenerates or replaces that image. No known POP chain is present in the vulnerable software, so there is no direct impact. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

## References

- https://wpsec.com/vuln/WPSEC-2026-1326/
- https://plugins.svn.wordpress.org/image-sizes/tags/6.10.0/
- https://wordpress.org/plugins/image-sizes/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1326/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.