Unauthorized Data Deletion Vulnerability in Find Unused Images Plugin for WordPress

CVE-2025-11996

What is CVE-2025-11996?

The Find Unused Images plugin for WordPress contains a significant vulnerability that allows unauthorized attackers to delete all attachments on a site. This issue arises from missing capability checks in the fui_delete_image() and fui_delete_all_images() functions, permitting any unauthenticated user to exploit the plugin. As a result, site owners are urged to update their plugins promptly or implement necessary security measures to safeguard their data.

References