CVE-2025-10145
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Published: 1761632138
- Last modified: 1761632138
CVE-2025-10145 — The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via the upload_to_library function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the… [Severity (CVSS) 7.7]
Related CVE by CWE
No related CWE found.
Top CVE for Vendor
No vendor taxonomy on this entry.
Recently Exploited Similar Vulnerabilities
No recent KEV-listed items for this vendor/product.
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via the upload_to_library function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieval.
🧠 Explainer: What this vulnerability means
Summary: The issue in the product by the vendor (CWE: unspecified) may enable attacks.
Impact: It may allow privilege escalation, data exposure, or service interruption.
Mitigation: Prioritize patching and consider temporary workarounds documented by the vendor.
No vendor/product data yet.
No explicit mitigation/advisory links found in references.