CVE-2025-13794 is a missing authorization vulnerability (CWE-862) in the themeisle Auto Featured Image (Auto Post Thumbnail) WordPress plugin. The vulnerability exists because the bulk_action_generate_handler function does not perform proper capability checks, allowing authenticated users with Contributor-level privileges or higher to modify featured images on posts they do not own. This can lead to unauthorized modification of post data, specifically the deletion or generation of featured images. The vulnerability affects all versions up to and including 4.2.1. The CVSS 3.1 base score is 4.3, indicating medium severity, with an attack vector of network, low attack complexity, and requiring privileges. No vendor patch or advisory is currently provided.

An attacker with Contributor-level or higher access can delete or generate featured images on posts they do not own, leading to unauthorized modification of post content presentation. There is no impact on confidentiality or availability reported. The integrity of post metadata related to featured images is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor plugin updates from themeisle for a security patch. No known vendor-provided workaround or temporary fix is currently documented.