First published: Tue Apr 23 2024(Updated: )
The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_thumbnail and delete_thumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with contributor-level access and above, to delete thumbnails and add thumbnails to posts they did not author.
Credit: security@wordfence.com
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.