PT-2025-42230 · WordPress · Quick Featured Images

Lucas Montes · Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-11176

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Quick Featured Images plugin for WordPress versions prior to 13.7.3

Description The Quick Featured Images plugin for WordPress is susceptible to an Insecure Direct Object Reference issue in versions up to and including 13.7.2. This flaw is present in the qfi set thumbnail and qfi delete thumbnail AJAX actions due to a lack of validation on a user-controlled key. Authenticated attackers with Author-level access or higher can exploit this to modify or remove featured images from posts belonging to other users. The vulnerable key allows direct access to objects without proper authorization checks.

Recommendations Update the Quick Featured Images plugin to version 13.7.3 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-11176

Affected Products

Quick Featured Images

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11176 · Security Note
• https://t.me/cveNotify/138706 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4f9a1cfc-5e52-40da-bb9d-8f2b46d37c8c?source=cve · Note
• https://plugins.trac.wordpress.org/browser/quick-featured-images/tags/13.7.2/admin/class-Quick_Featured_Images_Columns.php#L506 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3376996%40quick-featured-images%2Ftrunk&old=3271680%40quick-featured-images%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1978562098645942436 · Twitter Post