A vulnerability exists in the WordPress plugin ONet Regenerate Thumbnails that allows an attacker to craft a forged HTTP request and cause an authenticated user to regenerate thumbnails automatically. The primary impact is the unwanted execution of a resource‑intensive operation, which may degrade service availability and increase server load. This flaw does not disclose data or execute arbitrary code but can be abused to drive traffic to vulnerable hosts.

The plugin is distributed under the Konrád Koller brand and is available through the WordPress plugin directory. Versions up to and including 1.5 are affected; newer releases contain the fix.

The CVSS score of 4.3 classifies this as moderately serious, while the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. The issue is not listed in the CISA KEV catalog. Attack would likely require the victim to be logged into their WordPress site and to visit a malicious page that submits a CSRF‑unsanctioned request. No special privileges beyond a normal user account are required, making the attack vector broadly accessible.