CVE-2025-11176 describes an Insecure Direct Object Reference vulnerability in the Quick Featured Images plugin for WordPress. The issue arises from insufficient validation of a user-controlled key parameter in the qfi_set_thumbnail and qfi_delete_thumbnail AJAX actions. This allows authenticated users with Author-level privileges or above to manipulate featured images of other users' posts, bypassing intended authorization controls. The vulnerability affects all versions up to and including 13.7.2. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and resulting in integrity impact without confidentiality or availability impact.

An attacker with Author-level access or higher can change or remove featured images on posts they do not own, potentially leading to unauthorized content manipulation. There is no impact on confidentiality or availability reported. The integrity of post presentation is affected, which may impact site content trustworthiness or user experience.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access carefully and monitor for suspicious activity related to featured image changes. Avoid granting Author-level privileges to untrusted users. Follow vendor updates for any official patches or mitigations.