The Featured Image Plus plugin is missing an authorization check in its fip_save_attach_featured handler. As a result, any authenticated user with Subscriber or higher privileges can trigger this function and change the featured image on arbitrary posts. This flaw allows an attacker to alter multimedia content, potentially misleading site visitors or facilitating social engineering attacks. The weakness stems from improper access control (CWE‑284) and insufficient verification of user capabilities (CWE‑862).

The vulnerability affects WordPress sites running the Featured Image Plus plugin version 1.6.4 and earlier. It is relevant to all installations of the plugin under the Krasenslavov author, including those using Bulk Edit Featured Images, Unsplash, and Alt Text Manager components. Users should verify that they are running a patched version or remove the plugin.

The CVSS base score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in CISA's KEV catalog. However, because the flaw requires only authenticated access and involves existing Subscriber-level permissions, an attacker who gains or has such access can exploit it with minimal effort. The impact is limited to post featured images and does not expose confidential data or enable remote code execution.