Featured Image CVE-2026-96671

Exploitation requires a victim who is currently authenticated to WordPress with sufficient privileges (typically an administrator managing the plugin) to be tricked into interacting with attacker-controlled content (UI:R), which triggers a forged state-changing request to the Featured Image from URL plugin. The attack is limited by: (1) mandatory user interaction, so it cannot be automated or executed server-to-server; (2) dependence on the victim having an active authenticated session; and (3) the absence of a valid anti-CSRF nonce check on the affected plugin action in versions through 6.0.7. The specific plugin feature/endpoint lacking nonce protection is not named in the available description and should be confirmed against the Patchstack advisory.

The input assigns CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), which rates this CSRF as high severity with full High confidentiality, integrity, and availability impact. However, this rating should be treated with caution: the description (CWE-352, 'CSRF allows Cross Site Request Forgery') provides no detail about WHICH privileged action the forged request triggers, so the claimed C:H/I:H/A:H impact is not substantiated by the available text and appears to be a conservative worst-case from the reporter. No EPSS score, SSVC decision, KEV listing, or POC indicator was provided in the input. Per the precision rules, exploitation status is 'no public exploit identified at time of analysis.' The genuinely limiting signal is UI:R - exploitation is not automatable and requires tricking an authenticated privileged user (typically an admin) into visiting a malicious page while logged in. Net: this is a plausible but not high-priority issue absent evidence of active exploitation or a public exploit; the raw 8.8 overstates real-world urgency because the triggering action and its true impact are unspecified and user interaction gates every attack. EPSS is missing, so widespread automated exploitation probability cannot be confirmed.

An attacker crafts a malicious web page containing a hidden auto-submitting form or request targeting the Featured Image from URL plugin's administrative action. When a logged-in WordPress administrator is lured into visiting that page (UI:R), their authenticated browser silently submits the forged request, causing an unintended state change in the plugin. No public exploit code is identified at time of analysis.