CVE-2026-7622Disclosure

LOWCVSS 4.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-deactivation AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the ThumbPress plugin on the affected site by sending a crafted POST request to admin-ajax.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-09-22); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters38d
Disclosure
CVE-2026-7622: ThumbPress WordPress plugin, unauthorized access via missing capability/nonce checks lets Subscribers deactivate the plugin. CVSS 4.3. Patch under review - watch for updates https://www.valtersit.com/cve/CVE-2026-7622 #CVE #WordPress #infosec #ThumbPress #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The post announces CVE-2026-7622 technical details (missing capability/nonce checks, subscriber deactivation, CVSS 4.3) without confirming active exploitation, naming a specific patch/remediation, or providing PoC/exploit code, resulting in a Disclosure classification.
0000038
1.1K followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-7622 The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verif… https://www.cve.org/CVERecord?id=CVE-2026-7622
Post summary
The text announces a vulnerability in the ThumbPress WordPress plugin, detailing the technical cause as missing capability checks and nonce verification, without mentioning any exploits, patches, or active attacks.
00000800
58.1K followersView on X

Explore more

Back to dashboard