CVE-2025-13794
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2Description
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulk_action_generate_handler function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete or generate featured images on posts they do not own.
Analysis
Authenticated attackers with Contributor-level access or above can delete or generate featured images on posts they do not own in the Auto Featured Image (Auto Post Thumbnail) WordPress plugin through version 4.2.1, due to a missing capability check in the bulk_action_generate_handler function. The vulnerability requires user authentication and has a CVSS score of 4.3; no public exploit code or active exploitation has been confirmed at the time of analysis.
Technical Context
The Auto Featured Image plugin for WordPress implements a bulk action handler (bulk_action_generate_handler) that processes requests to generate or delete featured images on posts. The function fails to verify whether the authenticated user has the capability to modify the target posts (CWE-862: Missing Authorization). WordPress capability checks typically verify post ownership or administrative permissions; the absence of such checks allows any authenticated user with Contributor status or higher to manipulate featured image metadata on arbitrary posts. This is a server-side authorization flaw in a PHP/WordPress plugin context where post modification permissions should be enforced before processing bulk actions.
Affected Products
The Auto Featured Image (Auto Post Thumbnail) WordPress plugin is vulnerable in all versions up to and including 4.2.1. The vulnerable code is located in the class-plugin.php file at the bulk_action_generate_handler function. WordPress sites with this plugin installed at version 4.2.1 or earlier are affected; the vulnerability applies to any installation where Contributor-level users or above exist.
Remediation
Update the Auto Featured Image (Auto Post Thumbnail) plugin to a patched version released after 4.2.1. Consult the WordPress plugin repository (https://plugins.trac.wordpress.org/browser/auto-post-thumbnail/) and the Wordfence threat intelligence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/29b0fd97-a669-42bb-b01e-bdc0395d697e?source=cve) for the exact fixed version. As an interim mitigation, administrators of WordPress sites relying on strict post authorship controls should audit user roles and restrict Contributor-level access to only trusted authors until an update is applied. Additionally, audit post featured image modification logs if available to detect unauthorized changes.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today