Quick Featured Images Vulnerability – Missing Authorization to Authenticated (Contributor+) Arbitrary Thumbnail Deletion/Setting – CVE-2024-3664 | WordPress Plugin Vulnerability Report

Plugin Name: Quick Featured Images

Key Information:

  • Software Type: Plugin
  • Software Slug: quick-featured-images
  • Software Status: Active
  • Software Author: hinjiriyo
  • Software Downloads: 992,333
  • Active Installs: 50,000
  • Last Updated: May 6, 2024
  • Patched Versions: 13.7.1
  • Affected Versions: <= 13.7.0

Vulnerability Details:

  • Name: Quick Featured Images <= 13.7.0
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
  • CVE: CVE-2024-3664
  • CVSS Score: 4.3
  • Publicly Published: April 22, 2024
  • Researcher: Lucio Sá
  • Description: The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_thumbnail and delete_thumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with contributor-level access and above, to delete thumbnails and add thumbnails to posts they did not author.


The Quick Featured Images plugin for WordPress has a vulnerability in versions up to and including 13.7.0 that allows unauthorized modification of data due to missing capability checks. This vulnerability has been patched in version 13.7.1.

Detailed Overview:

The vulnerability in Quick Featured Images was identified by Lucio Sá and involves missing authorization checks within the set_thumbnail and delete_thumbnail functions. This flaw allows attackers with at least contributor-level access to delete or set thumbnails for posts without proper permissions. The risks associated with this vulnerability include unauthorized content modification and potential misuse of the media library, compromising the visual integrity of a website. The patch in version 13.7.1 addresses these concerns by implementing proper capability checks.

Advice for Users:

  • Immediate Action: Update to the patched version 13.7.1 immediately.
  • Check for Signs of Vulnerability: Review your posts for unexpected changes to thumbnails as a sign of compromise.
  • Alternate Plugins: While a patch is available, users might still consider other plugins that offer similar functionality as a precaution.
  • Stay Updated: Always ensure that your plugins are updated to the latest versions to avoid vulnerabilities.


The prompt response from the developers of Quick Featured Images to patch this vulnerability underscores the importance of timely updates. Users are advised to ensure that they are running version 13.7.1 or later to secure their WordPress installations.


Detailed Report: 

In today's digital landscape, your website serves as the front door to your business, playing a critical role in building trust and engagement with your audience. However, this asset is vulnerable to security risks that can undermine your business's integrity and the confidence of your users. A recent security issue with the popular WordPress plugin, Quick Featured Images, highlights the continuous threat of cyber vulnerabilities and the need for vigilance in website maintenance.

Risks and Potential Impacts:

The presence of this vulnerability in Quick Featured Images could lead to unauthorized content changes, compromising the visual integrity and informational accuracy of your website. Such breaches can diminish user trust and may be leveraged for further malicious activities, making your site a launching ground for attacks on users.

Overview of Previous Vulnerabilities:

This isn't the first time Quick Featured Images or similar plugins have faced security issues. Historically, plugins that deal with media files have been susceptible to various types of attacks, emphasizing the need for constant updates and monitoring.


For small business owners, maintaining a website's security can seem daunting, especially with limited time and resources. However, the consequences of neglecting this aspect of your digital presence can be far more costly. Implementing regular updates and monitoring systems for your website isn’t just about fixing bugs—it’s a crucial investment in your business’s online security and reputation. Ensuring that you are running the latest versions of all software, including WordPress plugins like Quick Featured Images, is fundamental to protecting your site from potential threats.

Staying proactive with updates and considering managed WordPress hosting or security services can significantly reduce the risk and complexity of managing website security on your own. Remember, in the realm of cybersecurity, an ounce of prevention is worth a pound of cure.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Quick Featured Images Vulnerability – Missing Authorization to Authenticated (Contributor+) Arbitrary Thumbnail Deletion/Setting – CVE-2024-3664 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment