The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_image() and fui_delete_all_images() functiosn in all versions up to, and including, 1.0.7. This makes it possible for unauthenticated attackers to delete all of a site's attachments.
References
Configurations
History
22 Dec 2025, 15:03
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Toastwebsites find Unused Images
Toastwebsites |
|
| CPE | cpe:2.3:a:toastwebsites:find_unused_images:*:*:*:*:*:wordpress:*:* | |
| References | () https://plugins.trac.wordpress.org/browser/find-unused-images/tags/1.0.7/inc/generic-functions.php#L44 - Product | |
| References | () https://plugins.trac.wordpress.org/browser/find-unused-images/tags/1.0.7/inc/generic-functions.php#L53 - Product | |
| References | () https://wordpress.org/plugins/find-unused-images/ - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa1964e-97e9-4166-89d5-788b336790b6?source=cve - Third Party Advisory |
12 Nov 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wordpress.org/plugins/find-unused-images/ - |
11 Nov 2025, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-11 04:15
Updated : 2025-12-22 15:03
NVD link : CVE-2025-11996
Mitre link : CVE-2025-11996
CVE.ORG link : CVE-2025-11996
JSON object : View
Products Affected
toastwebsites
- find_unused_images
CWE
CWE-862
Missing Authorization