PT-2025-12627 · Unknown · Generate Post Thumbnails

Nabil Irawan · Published 2025-03-24 · Updated 2025-03-24 · CVE-2025-30585

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions marynixie Generate Post Thumbnails versions 0.8 and earlier

Description The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into performing an unintended action, such as sending a request to the /api/v1/login endpoint with malicious parameters like username and password.

Recommendations For versions 0.8 and earlier, consider disabling the Generate Post Thumbnails feature until a patch is available to prevent potential CSRF attacks. Restrict access to sensitive API endpoints to minimize the risk of exploitation. Avoid using sensitive parameters in affected API endpoints until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-30585

Affected Products

Generate Post Thumbnails

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-30585 · Security Note
• https://twitter.com/VulmonFeeds/status/1904256392984199268 · Twitter Post
• https://twitter.com/CVEnew/status/1904175204407877978 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/generate-post-thumbnails/vulnerability/wordpress-generate-post-thumbnails-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/generate-post-thumbnails/vulnerability/wordpress-generate-post-thumbnails-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note