CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfi_set_thumbnail and qfi_delete_thumbnail AJAX actions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to change or remove featured images of other user's posts.
Explanation of Vulnerability in Simple Terms
Quick Featured Images versions 13.7.2 and earlier contain an authorization flaw that allows authenticated users to modify data they should not have access to. An attacker with low-level site access can alter content integrity through this vulnerability. The issue affects the plugin's permission model and does not require user interaction to exploit.
What an attacker can do
Modify or alter site data that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized users with basic site access can change featured image settings or related data.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site.
Key dates
External resources
