Server-Side Request Forgery Vulnerability in Auto Featured Image Plugin for WordPress
CVE-2025-10145
7.7HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 28 October 2025
What is CVE-2025-10145?
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress has a vulnerability that allows authenticated attackers with Author-level access and above to exploit the upload_to_library function. This issue permits the execution of arbitrary web requests originating from the web application, posing significant risks to internal services. In cloud configurations, this vulnerability can also enable unauthorized access to sensitive metadata, potentially exposing critical information.
Affected Version(s)
Auto Featured Image (Auto Post Thumbnail) * <= 4.1.7