CVE-2024-3664: 
WordPress vulnerability analysis and mitigation

The Quick Featured Images plugin for WordPress contains a vulnerability (CVE-2024-3664) due to a missing capability check on the set_thumbnail and delete_thumbnail functions in versions up to and including 13.7.0. This vulnerability was discovered and reported by Wordfence, with the initial disclosure made on April 23, 2024 (NVD).

The vulnerability stems from insufficient capability checks in the plugin's set_thumbnail and delete_thumbnail functions. The issue has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (Wordfence).

The vulnerability allows authenticated attackers with contributor-level access or higher to delete thumbnails and add thumbnails to posts they did not author, potentially compromising the integrity of content management on affected WordPress installations (NVD).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

Website administrators running the Quick Featured Images plugin should update to a version newer than 13.7.0 once available. In the meantime, it is recommended to review and potentially restrict contributor-level access to minimize the risk (Wordfence).