CVE-2026-15384 WordPress CVE debrief

Who should care

WordPress site administrators and users with subscriber-level access should be aware of this vulnerability and take necessary actions to protect their sites. They should verify and update the Manual Image Crop plugin to version 1.15 or later, and ensure that only authorized users have access to sensitive media management functions. Additionally, they should monitor for suspicious activity related to media uploads and modifications. Site owners and security teams should review the vulnerability details and assess their exposure to this issue. They should also consider implementing compensating controls for exposed systems while remediation is scheduled and verified. Furthermore, they should track exceptions, retest remediated assets, and close the item only after evidence is documented. This vulnerability can be mitigated by updating the plugin and restricting access to media management functions. However, defenders should verify the effectiveness of these mitigations and monitor for potential exploitation attempts. The vulnerability affects WordPress sites using the Manual Image Crop plugin, and its exploitation could lead to unintended changes to media metadata and potential defacement of user content. Therefore, it is essential for site administrators to prioritize the update and review their site's security posture. They should also educate users with subscriber-level access about the risks associated with this vulnerability and the importance of secure media management practices. By taking these steps, site administrators can minimize the risk of exploitation and protect their sites from potential attacks. The vulnerability is a reminder of the importance of maintaining up-to-date software and implementing robust security measures to prevent exploitation. Site administrators should review their site's security configuration and ensure that all necessary security controls are in place to prevent exploitation of this vulnerability. They should also consider implementing additional security measures, such as monitoring for suspicious activity and restricting access to sensitive media management functions. By prioritizing the update and taking proactive steps to

Technical summary

The Manual Image Crop WordPress plugin before 1.15 does not perform capability checks or nonce verification for authenticated AJAX actions that crop attachment images. A subscriber-level user can supply an arbitrary attachment ID and overwrite the generated intermediate-size image and mutate stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library.

Defensive priority

WordPress site administrators and users with subscriber-level access should verify and update the Manual Image Crop plugin to version 1.15 or later, and ensure that only authorized users have access to sensitive media management functions.

Recommended defensive actions

• Update the Manual Image Crop plugin to version 1.15 or later
• Verify that only authorized users have access to sensitive media management functions
• Monitor for suspicious activity related to media uploads and modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The Manual Image Crop WordPress plugin before 1.15 does not perform capability checks or nonce verification for authenticated AJAX actions that crop attachment images. A subscriber-level user can supply an arbitrary attachment ID and overwrite the generated intermediate-size image and mutate stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.