PT-2025-44086 · WordPress · Auto Featured Image

Published 2025-10-28 · Updated 2025-11-01 · CVE-2025-10145

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Auto Featured Image (Auto Post Thumbnail) plugin for WordPress versions prior to 4.1.8

Description The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF) in versions up to and including 4.1.7. This flaw resides within the upload to library function, allowing authenticated attackers with Author-level access or higher to initiate web requests to arbitrary locations from the web application. Successful exploitation can enable attackers to query and modify information from internal services. On Cloud instances, this issue permits metadata retrieval.

Recommendations Update the Auto Featured Image (Auto Post Thumbnail) plugin to version 4.1.8 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-10145

Affected Products

Auto Featured Image

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-10145 · Security Note
• https://twitter.com/CVEnew/status/1983048890292002909 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1983090157554143366 · Twitter Post
• https://t.me/CVEtracker/35931 · Telegram Post
• https://t.me/cveNotify/140616 · Telegram Post
• https://plugins.trac.wordpress.org/browser/auto-post-thumbnail/tags/4.1.7/includes/class-apt.php#L821 · Note
• https://twitter.com/MNovofastovsky/status/1984562350964289780 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/93acfae6-470b-4637-b76b-e1162b80253f?source=cve · Note