CVE-2026-24535: 
WordPress vulnerability analysis and mitigation

CVE-2026-24535 is a Missing Authorization (Broken Access Control) vulnerability in the Automatic Featured Images from Videos WordPress plugin developed by WebDevStudios. It affects all versions up to and including 1.2.7, and was disclosed on January 23, 2026, with a patch released in version 1.2.8. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. Specifically, a function accessible to low-privileged authenticated users (Contributor or higher) lacks proper nonce token or capability checks, allowing those users to trigger actions intended for higher-privileged roles. This falls under OWASP Top 10 category A1: Broken Access Control. The vulnerability was discovered and reported by security researcher Nabil Irawan and disclosed via Patchstack on January 25, 2026 (Patchstack).

Successful exploitation allows an authenticated attacker with at least Contributor-level access to perform unauthorized actions within the WordPress site, resulting in a low integrity impact. There is no confidentiality or availability impact associated with this vulnerability. While the scope is limited to the affected WordPress installation, mass-exploit campaigns targeting WordPress plugins of this type are common, making even low-severity issues relevant for sites with untrusted contributor accounts (Patchstack).

The EPSS score for this vulnerability is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the wild. No public proof-of-concept exploit code, active in-the-wild exploitation, or threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Automatic Featured Images from Videos plugin version ≤ 1.2.7 using tools like WPScan or Shodan with WordPress plugin fingerprinting.
2. Obtain low-privileged access: Register or obtain credentials for a Contributor or higher-level account on the target WordPress site.
3. Identify vulnerable function: Locate the plugin function that lacks proper authorization or nonce checks — this function is intended for higher-privileged users but is accessible to Contributors.
4. Send crafted request: Submit a direct HTTP request (e.g., via the WordPress admin-ajax endpoint or a REST API call) invoking the unprotected function, bypassing the intended access control.
5. Achieve unauthorized action: The server executes the privileged action (e.g., modifying plugin settings or featured image assignments) without verifying the user's actual permission level (Patchstack).

• Logs: WordPress access logs showing POST requests to wp-admin/admin-ajax.php or REST API endpoints associated with the automatic-featured-images-from-videos plugin from Contributor-level user accounts.
• Logs: Unexpected plugin-related actions (e.g., featured image changes) attributed to low-privileged user accounts in WordPress activity logs.
• File System: Unexpected modifications to post featured image metadata in the WordPress database (wp_postmeta table) not initiated by editors or administrators.

The vendor has released version 1.2.8 of the Automatic Featured Images from Videos plugin, which resolves this vulnerability. Site administrators should update the plugin immediately via the WordPress dashboard or by downloading the patched version from the WordPress plugin repository. As a temporary workaround, restricting Contributor-level user registration or removing untrusted Contributor accounts can reduce exposure. Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically (Patchstack).