CVE-2025-11996

MEDIUM 5.3CVE-2025-11996 · Published 11/11/2025 · updated 07/10/2026

In short

CVE-2025-11996 is a MEDIUM (CVSS 5.3) vulnerability affecting find unused images (toastwebsites).
Chance of exploitation in the next 30 days (EPSS): 0.38%, higher than 31.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
find unused images toastwebsites	`≤ 1.0.7`	No fix yet

Description

The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_image() and fui_delete_all_images() functiosn in all versions up to, and including, 1.0.7. This makes it possible for unauthenticated attackers to delete all of a site's attachments.

References

plugins.trac.wordpress.org/browser/find-unused-images/tags/1.0.7/inc/generic-functions.php · Product
plugins.trac.wordpress.org/browser/find-unused-images/tags/1.0.7/inc/generic-functions.php · Product
wordpress.org/plugins/find-unused-images · Product
wordfence.com/threat-intel/vulnerabilities/id/3aa1964e-97e9-4166-89d5-788b336790b6 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free