CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through <= 5.0.4.
Explanation of Vulnerability in Simple Terms
Auto Featured Image versions up to 5.0.4 contain a server-side request forgery vulnerability. An authenticated attacker with low privileges can make the site send HTTP requests to internal or external systems on their behalf. The vulnerability requires high attack complexity but can affect confidentiality and integrity of data accessed through those requests.
What an attacker can do
Make the site send HTTP requests to internal systems or external URLs on the attacker's behalf.
Potential impact on your site
Attackers with basic WordPress accounts can probe internal networks, access private APIs, or trigger actions on external services.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
