CVE-2023-0477: Auto Featured Image < 3.9.16 - Author+ Arbitrary File Upload

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-13 · updated 2026-06-17
Weakness: CWE-434

Description

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation.

Affected products

Auto Featured Image (Auto Post Thumbnail): before 3.9.16 — fixed in 3.9.16

How to fix

Upgrade to a fixed version: Auto Featured Image (Auto Post Thumbnail) 3.9.16. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/e5ef74a2-e04a-4a14-bd0e-d6910cd1c4b4
https://wpscan.com/vulnerability/e5ef74a2-e04a-4a14-bd0e-d6910cd1c4b4

Get alerted when CVE-2023-0477 or the next vulnerability affects your stack