CVE-2024-3664

Name of the Vulnerable Software and Affected Versions Quick Featured Images plugin for WordPress versions up to, and including, 13.7.0

Description The issue allows authenticated attackers with contributor-level access and above to modify data without authorization. This is due to a missing capability check on the set thumbnail and delete thumbnail functions. As a result, attackers can delete thumbnails and add thumbnails to posts they did not author.

Recommendations For versions up to, and including, 13.7.0, update to a version that includes a fix for the missing capability check on the set thumbnail and delete thumbnail functions. As a temporary workaround, consider restricting access to the set thumbnail and delete thumbnail functions to prevent unauthorized modification of data.