CVE-2025-4431
📋 TL;DR
This vulnerability allows authenticated WordPress users with Subscriber-level access or higher to modify the featured image of any post without proper authorization. It affects all WordPress sites using the Featured Image Plus plugin up to version 1.6.3. The issue stems from missing capability checks in the fip_save_attach_featured function.
💻 Affected Systems
- Featured Image Plus – Quick & Bulk Edit with Unsplash WordPress plugin
📦 What is this software?
Featured Image Plus by Krasenslavov
⚠️ Risk & Real-World Impact
Worst Case
Attackers could deface websites by replacing legitimate featured images with malicious content, potentially spreading malware or inappropriate material across all posts.
Likely Case
Subscribers or low-privilege users could tamper with post images, causing content integrity issues and minor website defacement.
If Mitigated
With proper user role management and monitoring, impact would be limited to minor content modifications that can be quickly reverted.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple - attackers just need to craft HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.4 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/featured-image-plus/trunk/inc/admin/block-editor/block-editor-actions.php#L204
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Featured Image Plus – Quick & Bulk Edit with Unsplash'
4. Click 'Update Now' if available
5. Alternatively, download version 1.6.4+ from WordPress plugin repository
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate featured-image-plus
Restrict User Roles
allLimit Subscriber and Contributor role assignments
🧯 If You Can't Patch
- Remove the Featured Image Plus plugin entirely
- Implement strict user role management and audit all user accounts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Featured Image Plus version. If version is 1.6.3 or lower, you are vulnerable.Check Version:
wp plugin get featured-image-plus --field=versionVerify Fix Applied:
Verify plugin version is 1.6.4 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=fip_save_attach_featured from low-privilege users
- Unexpected featured image changes in post revision history
Network Indicators:
- HTTP POST requests containing 'fip_save_attach_featured' action parameter
SIEM Query:
source="wordpress_logs" action="fip_save_attach_featured" user_role="subscriber" OR user_role="contributor"