Atomic Edge analysis of CVE-2026-57720:
This vulnerability involves missing authorization in the ThumbPress plugin for WordPress, affecting versions up to and including 6.3.2. The core issue is that several AJAX handlers and helper functions lack proper capability checks, allowing authenticated attackers with subscriber-level access to perform actions restricted to administrators. The CVSS score is 4.3 (Medium).
Root Cause:
The primary root cause is the absence of a capability check in the `dismiss_pro_outdated_notice()` function in `/image-sizes/app/Bootstrap/AdminNotice.php` (line 48, vulnerable). This function previously called `update_option()` and `wp_send_json_success()` without verifying the user’s permissions. Similarly, multiple other files lack checks: the `image_sizes_dismiss()` function in `/image-sizes/legacy/app/AJAX.php` (line 84) had no capability check, and the `hide_notice()` method in `/image-sizes/legacy/classes/Notice.php` (line 124) was missing a `current_user_can()` call. The `is_admin()` method in `/image-sizes/app/Traits/Auth.php` (line 76) used `current_user_can(‘administrator’)` instead of the more specific `manage_options`, which could allow sandboxed users to bypass restrictions. Several AJAX handlers in the convert-images module, such as the one in `convert-images.php` (line 354), also lacked capability checks before executing privileged actions.
Exploitation:
An attacker with subscriber-level access can send a crafted POST request to `/wp-admin/admin-ajax.php` with the action parameter set to the applicable AJAX hook (e.g., a hook calling `dismiss_pro_outdated_notice`). The request does not require a valid nonce or any capability validation in the vulnerable versions. The attacker can specify arbitrary meta keys or options to update, such as `thumbpress_pro_outdated_notice_dismissed`. This allows the attacker to dismiss administrative notices or potentially manipulate other options if similar unprotected functions exist. No specific payload is needed beyond the standard AJAX parameters.
Patch Analysis:
The patch adds `current_user_can(‘manage_options’)` checks to multiple functions. In `AdminNotice.php`, the fix inserts a capability check and a nonce verification before the `update_option()` call. In `AJAX.php`, the `image_sizes_dismiss()` function now requires `manage_options` capability. The `hide_notice()` method in `Notice.php` receives both a capability check and a nonce verification. The `is_admin()` method in `Auth.php` changes from checking `administrator` role to checking `manage_options` capability, which is more precise. Nonce verifications are also improved by adding `isset()` checks and using `sanitize_text_field()` and `wp_unslash()` on user input.
Impact:
Successful exploitation allows authenticated attackers with minimal privileges (subscriber) to perform unauthorized actions, such as dismissing administrative notices, which could disrupt administrative workflows or hide warnings. More critically, the missing checks in the convert-images module could allow arbitrary file operations or image conversion tasks. This could lead to data exposure, denial of service, or further privilege escalation if combined with other vulnerabilities.
