Vulnerability · Published Aug 16, 2026 · Assigned by WPScan

CVE-2026-15384Manual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR

Medium 5.7

In plain English

A medium-severity improper authentication in Manual Image Crop from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)5.7Medium

Exploit odds (30 days)0.2%top 95.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Manual Image Crop	0 – before 1.15

Weakness: CWE-287, CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

References

https://wpscan.com/vulnerability/706d0b6a-d136-4317-a767-33bcab3b041c/ exploit, vdb-entry, technical-description