The Manual Image Crop WordPress plugin before version 1.15 contains an authentication bypass for its AJAX image cropping endpoint. The endpoint relies only on the existence of a logged‑in user, performing neither capability checks nor nonce verification. Consequently, any subscriber or higher‑privileged user can supply an arbitrary attachment ID and overwrite the generated intermediate‑size image—such as the thumbnail—and modify its stored metadata. This flaw allows a malicious user to impinge upon other users’ media, defacing content or masquerading as another author.

Affected systems are WordPress installations running the Manual Image Crop plugin with a version lower than 1.15. The vendor and product information is limited to the plugin name; no specific vendor is listed. The vulnerability is present in all plugins prior to the 1.15 release, regardless of the WordPress theme or other plugins in use.

The exploit is straightforward once a user is authenticated: an attacker sends an authenticated AJAX request targeting the cropping endpoint with a chosen attachment ID and the desired image data. Because there is no nonce and no capability validation, the request is accepted unconditionally. The absence of a CVSS or EPSS score means the formal severity is not quantified, but the capability to overwrite any user’s media and the lack of CSRF protection imply a high risk to data integrity and a potential for widespread defacement. The vulnerability is not listed in the CISA KEV database, and no EPSS value is available.