Manual Image Crop versions prior to 1.15 fail to perform proper capability checks or nonce verification on an authenticated AJAX action responsible for cropping attachment images. The only check is that the user is logged in, which permits subscriber-level users to supply arbitrary attachment IDs and overwrite generated intermediate-size images (e.g., thumbnails) and modify stored metadata regardless of ownership. This vulnerability constitutes improper authentication (CWE-287) and is also susceptible to CSRF (CWE-352) due to missing nonce protection. There is no vendor advisory or patch information provided, and no CVSS score is assigned.

An attacker with any authenticated user account, including low-privileged subscriber roles, can overwrite image thumbnails and mutate metadata of media attachments owned by other users. This compromises the integrity of media content across users, potentially leading to defacement or unauthorized content manipulation. The absence of nonce verification also allows CSRF attacks, enabling attackers to trigger these unauthorized modifications via crafted requests without user consent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles that can upload or manage media, and consider disabling or limiting use of the Manual Image Crop plugin. Monitor for updates from the plugin vendor and apply official patches once released.