The FPW Category Thumbnails plugin for WordPress omits an authorization check on its administrative endpoints, allowing an attacker who can reach those URLs to gain unauthorized control over the plugin’s configuration and content management. This flaw can be used to alter, delete, or add category thumbnails, potentially disrupting site appearance and functionality. The weakness is classified as CWE‑862, Unauthorized Access to a Resource.

Frank P. Walentynowicz’s FPW Category Thumbnails plugin for WordPress, versions up to and including 1.9.5, is impacted. No other products or version ranges are listed as affected.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% reflects a very low likelihood of exploitation and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is to send crafted HTTP requests to the plugin’s administrative URLs; based on the description, it is inferred that the attacker may need to be authenticated to the site or exploit another weakness that grants access to the management pages. If successful, the attacker would gain unauthorized administrative privileges over the plugin, compromising integrity and possibly affecting the broader WordPress site.