7.7
High
CVE-2025-10145 The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all…
Description
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via the upload_to_library function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieval.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Auto Featured Image (Auto Post Thumbnail) 4.1 | earliest → 4.1.7 | No fix stated |
Other CVEs of Auto Featured Image (Auto Post Thumbnail)
The 4 CVEs of Auto Featured Image (Auto Post Thumbnail) →
CVE-2026-61970
Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail)…
4.9
Medium
CVE-2025-13794
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data…
4.3
Medium
CVE-2023-7073
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all…
6.4
Medium