CVE-2023-7073: themeisle Auto Featured Image (Auto Post Thumbnail)

Описание

Оригинално описание

The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via the upload_to_library AJAX action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Засегнати продукти

• themeisle Auto Featured Image (Auto Post Thumbnail): до 4.1.7
• creative_motion auto_featured_image: до 4.0.0

Вид слабост

• CWE-918 Server-Side Request Forgery

История

Други уязвимости в themeisle Auto Featured Image (Auto Post Thumbnail)

• 4.9CVE-2026-61970
• 4.3CVE-2025-13794

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2023-7073
• https://nvd.nist.gov/vuln/detail/CVE-2023-7073
• https://www.wordfence.com/threat-intel/vulnerabilities/id/dc024183-0244-4ef9-9171-057ecd1c3e1d?source=cve
• https://plugins.trac.wordpress.org/browser/auto-post-thumbnail/tags/3.9.18/includes/class-apt.php#L947