Manual Image Crop plugin versions prior to 1.15 do not perform capability checks or nonce verification on the authenticated AJAX action responsible for cropping attachment images. The only check is that the user is logged in, which permits subscriber-level users to supply arbitrary attachment IDs and overwrite intermediate-size images (e.g., thumbnails) and alter stored metadata regardless of ownership. The absence of nonce verification additionally exposes the action to CSRF attacks. This results in a cross-user integrity and defacement issue within the WordPress Media Library.

An attacker with subscriber-level access can overwrite media library images and modify their metadata without ownership permissions, causing integrity violations and potential defacement of media content. The lack of nonce verification further allows CSRF attacks, enabling attackers to trigger these unauthorized changes via crafted requests.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and capabilities to trusted users only and monitor for suspicious activity related to media modifications. Avoid granting subscriber-level users unnecessary access to media management features.