CVE-2026-13432Disclosure

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/a408e8f9-4de7-4449-8fca-51ea46e4f433/

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-07-15); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Vulmon Vulnerability Feed@VulmonFeeds87d
Disclosure
CVE-2026-13432 Unauthorized Plugin Deactivation in ThumbPress WordPress Plugin B... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-13432 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The text announces CVE-2026-13432 as a vulnerability in ThumbPress WordPress Plugin B without providing technical details, PoC, or exploitation information.
0000093
4.1K followersView on X
Umut Can@umut_sec91d
Disclosure
✅ New CVE assigned! I’m happy to share that my latest vulnerability discovery has been officially assigned as CVE-2026-13432 and is now public. https://wpscan.com/vulnerability/a408e8f9-4de7-4449-8fca-51ea46e4f433/ #CyberSecurity #InfoSec #CVE #SecurityResearch #AppSec #VulnerabilityResearch #WebAppSecurity
Post summary
The author announces the official assignment of CVE-2026-13432 and links to the public WPScan page, but offers no technical or exploit details.
0000037
74 followersView on X

Explore more

Back to dashboard