Security Alert Summary
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access and above to generate or delete featured images on posts they do not own. The issue is due to a missing capability check in a bulk action handler and affects all versions up to and including 4.2.1.
CVE Details
- CVE ID: CVE-2025-13794
- Affected plugin / component: Auto Featured Image (Auto Post Thumbnail) plugin
- Affected versions: All versions up to, and including, 4.2.1
- Published: December 16, 2025 at 06:15:42 AM
- Last Modified: December 16, 2025 at 02:10:11 PM
- CVSS v3.1: Base Score 4.3, Severity MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: LOW (authenticated user)
- User Interaction: NONE
- Scope: UNCHANGED
- Confidentiality Impact: NONE
- Integrity Impact: LOW
- Availability Impact: NONE
- Vector:
- Authentication / Privileges: An authenticated user with Contributor-level access or higher can exploit this issue (as stated in the description).
- CWE / Weakness: CWE-862 (Missing Authorization)
Technical Details
According to the CVE entry, the vulnerability is caused by a missing capability check in the bulk_action_generate_handler function. Because the handler does not properly verify whether the acting user has capability to modify featured images on the target posts, authenticated users with Contributor-level privileges (and above) can trigger bulk actions to delete or generate featured images for posts they do not own.
The issue exists in all plugin versions up to and including 4.2.1. The primary technical impact is an integrity loss limited to post metadata (featured images); confidentiality and availability are not impacted according to the CVSS data.
How This Could Impact Your Website
Consider a site with multiple user roles: the site owner, an editor, several contributors, and an external contractor who helps with content. A contributor with legitimate permissions to upload images could use the affected bulk action to change or remove featured images on other authors’ posts. This can lead to inconsistent presentation, incorrect visual attribution, or misleading content on publication pages.
Because the impact is limited to integrity of featured images (no confidentiality impact reported), this vulnerability does not indicate exposure of private data or direct site takeover. However, altered images can still be used to create confusion or to craft misleading posts that may support social engineering or targeted messaging against site users or readers. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE states the issue affects versions up to and including 4.2.1; a fixed version is not specified in the CVE entry.)
- Review and reduce unnecessary user roles, especially contributor-level accounts that do not need media management capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual bulk image changes or unexpected media deletions.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
