Themeisle Auto Featured Image (Auto Post Thumbnail) vulnerabilities

3 vulnerabilities

Known vulnerabilities in Themeisle Auto Featured Image (Auto Post Thumbnail), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.3CVE-2025-13794themeisleauto featured image (auto post thumbnail)+1
EPSS score
0.30%
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulk_action_generate_handler function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete or generate featured images on posts they do not own.6.4CVE-2026-61970themeisleauto featured image (auto post thumbnail)+1
EPSS score
0.19%
Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through <= 5.0.4.6.4CVE-2023-7073themeisleauto featured image (auto post thumbnail)+1
EPSS score
0.26%
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via the upload_to_library AJAX action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.