CVE-2025-13794

MediumCVSS 4.3

Published: 16/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the bulk_action_generate_handler function in all versions up to and including 4.2.1. This allows authenticated attackers with Contributor-level access and above to delete or generate featured images on posts they do not own.

Risk Assessment

The risk involves unauthorized modification of post content, which could lead to data integrity issues and disruption of the website.

Recommendation

It is recommended to immediately update the plugin to the latest version that includes a fix for this issue.

Other vulnerabilities in Auto Featured Image (Auto Post Thumbnail)

CVE-2026-61970Medium
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress up to version 5.0.4 contains a Server-Side Request Forgery (SSRF) vulnerability. It allows an attacker to send requests from the server to internal network resources.

Original NVD description (English source)

The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulk_action_generate_handler function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete or generate featured images on posts they do not own.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS