PT-2025-46268 · WordPress · Find Unused Images

Johska · Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-11996

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Find Unused Images plugin for WordPress versions through 1.0.7

Description The Find Unused Images plugin for WordPress is susceptible to unauthorized data loss. This is due to a missing capability check within the fui delete image() and fui delete all images() functions. This allows unauthenticated attackers to delete all attachments associated with a WordPress site.

Recommendations Update the Find Unused Images plugin to a version later than 1.0.7.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11996

Affected Products

Find Unused Images

References · 7

• 🔥 https://wordpress.org/plugins/find-unused-images · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11996 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11996 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/find-unused-images/tags/1.0.7/inc/generic-functions.php#L53 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3aa1964e-97e9-4166-89d5-788b336790b6?source=cve · Note
• https://plugins.trac.wordpress.org/browser/find-unused-images/tags/1.0.7/inc/generic-functions.php#L44 · Note
• https://twitter.com/CVEnew/status/1988095339442655501 · Twitter Post