CVE-2025-13794
Unknown Unknown - Not Provided

Unauthorized Data Modification in Auto Featured Image WordPress Plugin

Publication date: 2025-12-16

Last updated on: 2026-04-08

Assigner: Wordfence

Description
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulk_action_generate_handler function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete or generate featured images on posts they do not own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-12-16
Last Modified
2026-04-08
Generated
2026-07-06
AI Q&A
2025-12-16
EPSS Evaluated
2026-07-04
NVD
CVE-2025-13794
EUVD
EUVD-2025-203499

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordpress auto_featured_image 4.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the Auto Featured Image (Auto Post Thumbnail) WordPress plugin allows authenticated users with Contributor-level access or higher to modify data without proper authorization. Specifically, due to a missing capability check in the bulk_action_generate_handler function, these users can delete or generate featured images on posts they do not own.

Impact Analysis

This vulnerability can impact you by allowing attackers with Contributor-level access or above to manipulate featured images on posts they do not own. This unauthorized modification can lead to unwanted changes in your website's content presentation, potentially damaging the site's appearance or misleading users.

Mitigation Strategies

To mitigate this vulnerability, immediately update the Auto Featured Image (Auto Post Thumbnail) plugin to a version later than 4.2.1 where the missing capability check on the bulk_action_generate_handler function is fixed. Additionally, restrict Contributor-level access and above to trusted users only, as the vulnerability allows authenticated users with Contributor-level access to modify featured images on posts they do not own.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13794. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart