CVE-2024-5677

Name of the Vulnerable Software and Affected Versions Featured Image Generator plugin for WordPress versions up to, and including, 1.3.1

Description The issue arises from a missing capability check on the fig save after generate image function, allowing authenticated attackers with Subscriber-level access and above to upload arbitrary images to a post-related gallery.

Recommendations For versions up to, and including, 1.3.1, update to a version that includes a fix for the missing capability check on the fig save after generate image function. As a temporary workaround, consider restricting access to the fig save after generate image function to prevent unauthorized image uploads.