Medium severity · published May 31, 2024
CVE-2023-7073
Auto Featured Image (Auto Post Thumbnail) <= 4.1.7 - Authenticated (Author+) Server-Side Request Forgery
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via the upload_to_library AJAX action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Auto Featured Image (Auto Post Thumbnail) · themeisle
through 4.1.7 · source: vendor
AF
Auto Featured Image · Creative Motion
through 4.0.0 · source: CISA
Affected product
AF
Auto Featured Image (Auto Post Thumbnail)
themeisle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-7073
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-7073
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/auto-post-thumbnail/tags/3.9.18/includes/class-apt.php#L947
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/dc024183-0244-4ef9-9171-057ecd1c3e1d?source=cve
More from Auto Featured Image (Auto Post Thumbnail)
4.9
CVE-2026-61970
WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability
4.3
CVE-2025-13794
Auto Featured Image <= 4.2.1 - Missing Authorization to Authenticated (Contributor+) Post Thumbnail Modification