Draw Attention < 2.0.12 - Subscriber+ Unauthorized Featured Image Modification

The plugin does not perform a capability check on the ajax_set_featured_image function, allowing authenticated users with subscriber-level permissions to modify featured images of arbitrary posts using images from the media library.