Home

Description

The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfi_set_thumbnail and qfi_delete_thumbnail AJAX actions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to change or remove featured images of other user's posts.

PUBLISHED Reserved 2025-09-29 | Published 2025-10-15 | Updated 2025-10-15 | Assigner Wordfence




MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Default status
unaffected

*
affected

Timeline

2025-10-14:Disclosed

Credits

Lucas Montes finder

References

www.wordfence.com/...-5e52-40da-bb9d-8f2b46d37c8c?source=cve

plugins.trac.wordpress.org/...ck_Featured_Images_Columns.php

plugins.trac.wordpress.org/...%2Ftrunk&sfp_email=&sfph_mail=

cve.org (CVE-2025-11176)

nvd.nist.gov (CVE-2025-11176)

Download JSON