PT-2025-51372 · WordPress · Auto Featured Image

Dmitry Ignatyev · Published 2025-12-16 · Updated 2025-12-17 · CVE-2025-13794

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Auto Featured Image (Auto Post Thumbnail) plugin for WordPress versions through 4.2.1

Description The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress has a flaw that allows unauthorized modification of data. A missing capability check within the bulk action generate handler function permits authenticated attackers with Contributor-level access or higher to delete or generate featured images on posts they are not authorized to manage.

Recommendations Update the Auto Featured Image (Auto Post Thumbnail) plugin to a version later than 4.2.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13794

Affected Products

Auto Featured Image

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13794 · Security Note
• https://t.me/cveNotify/145903 · Telegram Post
• https://plugins.trac.wordpress.org/browser/auto-post-thumbnail/tags/4.2.1/includes/class-plugin.php#L425 · Note
• https://twitter.com/CVEnew/status/2001365825505108172 · Twitter Post
• https://t.me/CVEtracker/39923 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/29b0fd97-a669-42bb-b01e-bdc0395d697e?source=cve · Note
• https://research.cleantalk.org/cve-2025-13794 · Note