What is the CVSS score of CVE-2025-13794?

CVE-2025-13794 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-13794

MEDIUM

Missing Authorization (CWE-862)

2025-12-16 security@wordfence.com

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 17:22 vuln.today

CVE Published

Dec 16, 2025 - 06:15 nvd

MEDIUM 4.3

DescriptionCVE.org

The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulk_action_generate_handler function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete or generate featured images on posts they do not own.

AnalysisAI

Authenticated attackers with Contributor-level access or above can delete or generate featured images on posts they do not own in the Auto Featured Image (Auto Post Thumbnail) WordPress plugin through version 4.2.1, due to a missing capability check in the bulk_action_generate_handler function. The vulnerability requires user authentication and has a CVSS score of 4.3; no public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The Auto Featured Image plugin for WordPress implements a bulk action handler (bulk_action_generate_handler) that processes requests to generate or delete featured images on posts. The function fails to verify whether the authenticated user has the capability to modify the target posts (CWE-862: Missing Authorization). WordPress capability checks typically verify post ownership or administrative permissions; the absence of such checks allows any authenticated user with Contributor status or higher to manipulate featured image metadata on arbitrary posts. This is a server-side authorization flaw in a PHP/WordPress plugin context where post modification permissions should be enforced before processing bulk actions.

Affected ProductsAI

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin is vulnerable in all versions up to and including 4.2.1. The vulnerable code is located in the class-plugin.php file at the bulk_action_generate_handler function. WordPress sites with this plugin installed at version 4.2.1 or earlier are affected; the vulnerability applies to any installation where Contributor-level users or above exist.

RemediationAI

Update the Auto Featured Image (Auto Post Thumbnail) plugin to a patched version released after 4.2.1. Consult the WordPress plugin repository (https://plugins.trac.wordpress.org/browser/auto-post-thumbnail/) and the Wordfence threat intelligence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/29b0fd97-a669-42bb-b01e-bdc0395d697e?source=cve) for the exact fixed version. As an interim mitigation, administrators of WordPress sites relying on strict post authorship controls should audit user roles and restrict Contributor-level access to only trusted authors until an update is applied. Additionally, audit post featured image modification logs if available to detect unauthorized changes.