CVE-2024-5677: 
WordPress vulnerability analysis and mitigation

The Featured Image Generator plugin for WordPress contains a vulnerability (CVE-2024-5677) related to unauthorized image upload functionality. The vulnerability exists due to a missing capability check on the fig_save_after_generate_image function in versions up to and including 1.3.1. This vulnerability was discovered and reported by Wordfence, with an initial disclosure date of July 9, 2024 (Wordfence Intel).

The vulnerability stems from insufficient security controls in the fig_save_after_generate_image function, specifically the absence of proper capability checks. The severity of this vulnerability has been assessed with a CVSS v3.1 base score of 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability can be found in the plugin's admin functionality, specifically in the class-featured-image-generator-admin.php file (WordPress Plugin).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to upload arbitrary images to a post-related gallery. This could potentially lead to unauthorized content manipulation and storage space abuse on affected WordPress installations (Wordfence Intel).

The vulnerability requires authentication with at least Subscriber-level access, making it exploitable by any authenticated user regardless of their permission level. The attack complexity is considered low, requiring no special conditions or user interaction to exploit (Wordfence Intel).

Website administrators running the Featured Image Generator plugin should update to a version newer than 1.3.1 if available. If an update is not available, it is recommended to restrict user roles and permissions or consider disabling the plugin until a patch is released (Wordfence Intel).