CVE-2025-4431CWE-284

Featured Image Plus <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Featured Image Update

Medium · published May 30, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
20.9
In the wild
Unconfirmed
What it is

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fip_save_attach_featured function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update featured image of any post.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00294 · 20.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-05-30T07:23Z
EPSS history
Timeline
  • 30 MAY 07:23Z
    Featured Image Plus <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Featured Image Update
    cvelistv5