CVE-2025-11176
📋 TL;DR
The Quick Featured Images WordPress plugin has an Insecure Direct Object Reference vulnerability that allows authenticated attackers with Author-level permissions or higher to modify or delete featured images from other users' posts. This affects all plugin versions up to 13.7.2. The vulnerability exists due to insufficient validation of user-controlled parameters in AJAX handlers.
💻 Affected Systems
- WordPress Quick Featured Images plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Malicious authors could systematically deface or sabotage content across the WordPress site by removing or replacing featured images on posts they don't own, potentially damaging content integrity and user experience.
Likely Case
Author-level users could accidentally or intentionally modify featured images on posts they shouldn't have access to, causing content management issues and minor disruptions.
If Mitigated
With proper role-based access controls and monitoring, impact would be limited to isolated incidents quickly detected and remediated.
🎯 Exploit Status
Exploitation requires authenticated access with at least Author privileges. Attackers need to understand WordPress AJAX endpoints and post ID enumeration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 13.7.3 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Quick Featured Images' and check if update is available. 4. Click 'Update Now' to upgrade to version 13.7.3 or later. 5. Verify the plugin is active and functioning.
🔧 Temporary Workarounds
Disable vulnerable AJAX endpoints
allRemove or restrict access to the qfi_set_thumbnail and qfi_delete_thumbnail AJAX actions via .htaccess or WordPress hooks
Add to theme's functions.php: remove_action('wp_ajax_qfi_set_thumbnail', 'qfi_set_thumbnail_callback'); remove_action('wp_ajax_qfi_delete_thumbnail', 'qfi_delete_thumbnail_callback');
Temporary plugin deactivation
WordPress CLIDisable the Quick Featured Images plugin until patched
wp plugin deactivate quick-featured-images
🧯 If You Can't Patch
- Restrict Author role permissions using a role management plugin to prevent post modification capabilities
- Implement additional access controls at web server level to monitor and restrict AJAX requests to vulnerable endpoints
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Quick Featured Images version. If version is 13.7.2 or lower, system is vulnerable.Check Version:
wp plugin get quick-featured-images --field=versionVerify Fix Applied:
After updating, verify plugin version shows 13.7.3 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual AJAX requests to /wp-admin/admin-ajax.php with action parameters qfi_set_thumbnail or qfi_delete_thumbnail from Author-level users
- Multiple featured image changes from single user account in short time period
Network Indicators:
- POST requests to WordPress AJAX endpoints with post_id parameters that don't belong to the requesting user
SIEM Query:
source="wordpress.log" AND (action="qfi_set_thumbnail" OR action="qfi_delete_thumbnail") AND user_role="author" AND post_owner!=current_user🔗 References
- https://plugins.trac.wordpress.org/browser/quick-featured-images/tags/13.7.2/admin/class-Quick_Featured_Images_Columns.php#L506
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3376996%40quick-featured-images%2Ftrunk&old=3271680%40quick-featured-images%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4f9a1cfc-5e52-40da-bb9d-8f2b46d37c8c?source=cve
