Insecure Direct Object Reference Vulnerability in Quick Featured Images Plugin for WordPress

CVE-2025-11176

What is CVE-2025-11176?

The Quick Featured Images plugin for WordPress is susceptible to an Insecure Direct Object Reference due to inadequate validation on a user-controlled key in AJAX actions. This flaw affects all versions up to and including 13.7.2. Authenticated attackers with Author-level access permit the unauthorized change or deletion of featured images associated with other users' posts, potentially leading to unauthorized content manipulation.

References