CVE-2025-11996 Overview
CVE-2025-11996 is a missing authorization vulnerability in the Find Unused Images plugin for WordPress, developed by toastwebsites. The flaw affects all versions up to and including 1.0.7. The plugin fails to enforce capability checks on the fui_delete_image() and fui_delete_all_images() functions. Unauthenticated attackers can invoke these functions remotely to delete every attachment stored on the affected WordPress site. The issue is classified under [CWE-862] (Missing Authorization).
Critical Impact
Unauthenticated network attackers can delete all media attachments on a WordPress site running Find Unused Images 1.0.7 or earlier, causing data loss and integrity impact.
Affected Products
- Toastwebsites Find Unused Images plugin for WordPress
- All versions up to and including 1.0.7
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2025-11-11 - CVE-2025-11996 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11996
Vulnerability Analysis
The Find Unused Images plugin exposes two callable functions responsible for deleting media attachments: fui_delete_image() and fui_delete_all_images(). Neither function verifies whether the requester holds the appropriate WordPress capability, such as manage_options or delete_posts. The plugin also omits nonce validation. As a result, any HTTP request that reaches these handlers can trigger deletion of media library items without authentication. The vulnerability affects integrity by permitting unauthorized data loss across the site's attachment store.
Root Cause
The root cause is a missing authorization check inside the plugin's generic function handlers located in inc/generic-functions.php. The affected code paths at lines 44 and 53 dispatch deletion operations without calling current_user_can() or verifying a WordPress nonce through check_admin_referer() or wp_verify_nonce(). This design flaw grants unauthenticated callers the same delete privileges as an administrator for the exposed action.
Attack Vector
Exploitation requires no authentication, no user interaction, and no elevated privileges. An attacker sends a crafted HTTP request to the WordPress endpoint that dispatches the vulnerable AJAX or admin-post action registered by the plugin. Successful requests cause fui_delete_all_images() to iterate through the media library and remove every attachment. Because the attack is network-based and scriptable, automated scanners can identify and exploit vulnerable installations at scale.
For technical details on the vulnerable code paths, refer to the WordPress Plugin Source Code at line 44 and line 53.
Detection Methods for CVE-2025-11996
Indicators of Compromise
- Sudden disappearance of media library attachments without a corresponding administrator action in the WordPress audit log.
- HTTP requests to admin-ajax.php or admin-post endpoints referencing the fui_delete_image or fui_delete_all_images actions from unauthenticated sessions.
- Web server access logs showing repeated POST requests to WordPress admin endpoints from a single external IP address.
Detection Strategies
- Inventory WordPress deployments and flag any site running Find Unused Images version 1.0.7 or earlier.
- Alert on HTTP requests containing the strings fui_delete_image or fui_delete_all_images in the request body or query string.
- Correlate WordPress media deletion events with the requesting user identity to identify actions performed without an authenticated session.
Monitoring Recommendations
- Enable file integrity monitoring on the wp-content/uploads directory to detect mass deletions.
- Forward WordPress and web server logs to a centralized log platform for retention and anomaly detection.
- Configure alerts on abnormal spikes in DELETE database operations against the wp_posts table where post_type = 'attachment'.
How to Mitigate CVE-2025-11996
Immediate Actions Required
- Deactivate the Find Unused Images plugin on all WordPress sites until a patched release is available.
- Restrict access to WordPress admin endpoints using a web application firewall rule that blocks requests referencing the vulnerable action names.
- Verify that current media library backups exist and are restorable before performing any remediation.
Patch Information
At the time of publication, no fixed version has been listed in the vendor advisory. Review the Wordfence Vulnerability Report and the WordPress Plugin Overview for the latest patch status. Upgrade to a version newer than 1.0.7 as soon as the vendor publishes a fix.
Workarounds
- Remove the plugin directory from wp-content/plugins/find-unused-images/ if immediate deactivation through the admin console is not possible.
- Deploy a WAF rule that denies HTTP requests containing action=fui_delete_image or action=fui_delete_all_images.
- Restrict access to admin-ajax.php and admin-post endpoints from untrusted networks using IP allowlisting where operationally feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
