CVE Intelligence

Themeisle Auto Featured Image (Auto Post Thumbnail) vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Themeisle Auto Featured Image (Auto Post Thumbnail): 2 record(s), with affected versions and fixes.

CVE-2026-61970 Medium · 4.9 CWE-918 Jul 13, 2026
WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through <= 5.0.4.
CVE-2025-13794 Medium · 4.3 CWE-862 Dec 16, 2025
Auto Featured Image <= 4.2.1 - Missing Authorization to Authenticated (Contributor+) Post Thumbnail Modification
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulk_action_generate_handler function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete or generate featured images on posts they do not own.