The ThumbPress plugin for WordPress is vulnerable because the send_deactivation_survey() function, which is triggered via the wp_ajax_pl-plugin-deactivation AJAX action, performs no capability checks or nonce verification. As a result, any authenticated visitor with the Subscriber role or above can craft a POST request to admin-ajax.php and deactivate ThumbPress. This undermines the availability of the plugin’s image optimization features and can disrupt site functionality. The weakness is classified as CWE-862, Missing Authorization.

The vulnerability affects the codexpert ThumbPress plugin for WordPress, specifically all versions up to and including 6.2.1. No additional product or version details are provided beyond this range.

With a CVSS score of 4.3, the vulnerability is considered moderate in severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating limited publicly known exploitation. The required conditions are that the attacker be authenticated as a Subscriber or higher role, and that they manually send a crafted request to the AJAX endpoint. Therefore, the risk is primarily confined to authenticated users who can formulate the required request.