The Manual Image Crop WordPress plugin before version 1.15 performs no capability checks or nonce verification on its authenticated AJAX image‑cropping action. As a result, any logged‑in user, including subscribers, can supply an arbitrary attachment ID and overwrite that attachment’s generated intermediate‑size image, such as its thumbnail, and alter its stored metadata. This flaw constitutes a cross‑user integrity issue and a classic IDOR vulnerability, allowing an attacker to deface media exposed on the site.

WordPress installations running the Manual Image Crop plugin with a version lower than 1.15 are affected. No specific vendor is listed beyond the plugin name, and the flaw is independent of the active theme or other plugins. Any authenticated user with subscriber level or higher permissions can trigger the vulnerable AJAX endpoint.

The CVSS score of 5.7 indicates moderate severity, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV database. Exploitation requires only that a user be authenticated; the attacker sends an AJAX request to the cropping endpoint with a chosen attachment ID and the desired image payload. Because the endpoint accepts the request unconditionally, the attacker can overwrite any user’s media, and the lack of CSRF protection adds an additional attack vector.