CVE-2025-4431 is an improper access control vulnerability (CWE-284) in the WordPress plugin Featured Image Plus – Bulk Edit Featured Images, Unsplash & Alt Text Manager. The issue arises from the absence of a capability check in the fip_save_attach_featured function, allowing authenticated users with Subscriber-level privileges or higher to update the featured image of any post. This affects all versions up to and including 1.6.4. The vulnerability enables unauthorized modification of post featured images without requiring elevated privileges beyond Subscriber access.

The vulnerability allows authenticated users with low-level privileges (Subscriber and above) to modify the featured image of any post. This could lead to unauthorized content changes impacting the integrity of posts. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level user capabilities if possible or monitor for unauthorized changes to featured images. Avoid granting unnecessary privileges to low-level users.