CVE-2026-61970

MediumCVSS 4.9

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress up to version 5.0.4 contains a Server-Side Request Forgery (SSRF) vulnerability. It allows an attacker to send requests from the server to internal network resources.

Risk Assessment

The risk involves potential scanning of internal networks, access to sensitive data, or attacks on other systems within the infrastructure, which could lead to a security breach for the organization.

Recommendation

It is recommended to immediately update the Auto Featured Image plugin to a version newer than 5.0.4 if available, or apply temporary mitigations such as filtering outbound traffic.

Other vulnerabilities in Auto Featured Image (Auto Post Thumbnail)

CVE-2025-13794Medium
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the bulk_action_generate_handler function in all versions up to and including 4.2.1. This allows authenticated attackers with Contributor-level access and above to delete or generate featured images on posts they do not own.

Original NVD description (English source)

Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through <= 5.0.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS