CVE-2026-7622

Name of the Vulnerable Software and Affected Versions ThumbPress versions prior to 6.2.2

Description Authenticated users with Subscriber-level access and above can deactivate the plugin by sending a crafted POST request to the 'admin-ajax' endpoint. This occurs because the send deactivation survey() function, registered via the wp ajax pl-plugin-deactivation AJAX action, lacks necessary capability checks and nonce verification. A nonce is a unique token used to protect against cross-site request forgery.

Recommendations Update ThumbPress to version 6.2.2 or later.