CVE-2025-11996

Find Unused Images <= 1.0.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion

Published Nov 11, 2025 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_image() and fui_delete_all_images() functiosn in all versions up to, and including, 1.0.7. This makes it possible for unauthenticated attackers to delete all of a site's attachments.

Analysis

Technical impact

The Find Unused Images plugin for WordPress contains a missing capability check in its fui_delete_image() and fui_delete_all_images() functions in all versions up to 1.0.7. This flaw allows an attacker without authentication to execute those functions and delete every attachment stored on the site, effectively erasing media files and breaking references in posts or pages. The vulnerability is classified as CWE‑862, a missing authorization flaw that directly compromises data integrity.

Affected Systems

WordPress sites that have the Toastwebsites Find Unused Images plugin installed, specifically versions 1.0.7 and earlier.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity for missing authorization. The EPSS score of less than 1% suggests a low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable functions via HTTP requests to the plugin’s endpoints without needing authentication, making the exploitation path straightforward.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

toastwebsites

Find Unused Images

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0.7

Configuration 1 [-]

cpe:2.3:a:toastwebsites:find_unused_images:*:*:*:*:*:wordpress:*:*

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Find Unused Images plugin to the latest version that includes the missing authorization check.
Back up the WordPress database and the attachments directory before applying any update or change.
Verify that only users with sufficient capability (e.g., administrator) can trigger the delete functions and consider disabling or removing the plugin if it is not essential to site operation.

Generated by OpenCVE AI on April 22, 2026 at 12:00 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.376% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/find-unused-images/tags/1.0.7/inc/generic-functions.php#L44
https://plugins.trac.wordpress.org/browser/find-unused-images/tags/1.0.7/inc/generic-functions.php#L53
https://wordpress.org/plugins/find-unused-images/
https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa1964e-97e9-4166-89d5-788b336790b6?source=cve

History

Dec 22, 2025 3:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Toastwebsites Toastwebsites find Unused Images
CPEs		cpe:2.3:a:toastwebsites:find_unused_images::::::wordpress::*
Vendors & Products		Toastwebsites Toastwebsites find Unused Images

Nov 12, 2025 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 12, 2025 1:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress
Vendors & Products		Wordpress Wordpress wordpress

Nov 11, 2025 3:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_image() and fui_delete_all_images() functiosn in all versions up to, and including, 1.0.7. This makes it possible for unauthenticated attackers to delete all of a site's attachments.
Title		Find Unused Images <= 1.0.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/find-unused-images/tags/1.0.7/inc/generic-functions.php#L44 https://plugins.trac.wordpress.org/browser/find-unused-images/tags/1.0.7/inc/generic-functions.php#L53 https://wordpress.org/plugins/find-unused-images/ https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa1964e-97e9-4166-89d5-788b336790b6?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}`