CVE-2025-11176

MediumCVSS 4.3

Published: 15/10/2025(UTC)Updated: 11/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfi_set_thumbnail and qfi_delete_thumbnail AJAX actions due to missing validation on a user controlled key. This allows authenticated attackers with Author-level access or above to change or remove featured images of other users' posts.

Risk Assessment

The organization may face unauthorized content modification, potentially leading to data integrity issues and loss of user trust.

Recommendation

It is recommended to immediately update the Quick Featured Images plugin to the latest patched version and restrict user privileges to the minimum necessary.

Other vulnerabilities in Quick Featured Images

CVE-2025-11980Medium
The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to and including 13.7.3 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with Editor-level access and above to append additional SQL queries, provided they can convince an author-level user or higher to add a malicious custom field value.

Original NVD description (English source)

The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfi_set_thumbnail and qfi_delete_thumbnail AJAX actions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to change or remove featured images of other user's posts.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS