Recently, a plaintext-related image encryption scheme based on a hyper-chaotic system has been proposed by Li et al . In their encryption scheme, the permutation process is related to the sum of plaintext pixel values, and the diffusion process is related to the values of nine special positions in the permuted image. This can resist the existing chosen plaintext attack due to the ever-changing permutation matrix and diffusion matrix when the plaintext is changed. Here, we show that Li’s encryption scheme contains two vulnerabilities. First, the gray values of the nine specific pixels do not change during diffusion. Second, the permutation process is reversible. Therefore, the diffusion process can be attacked and the permuted image can be obtained by constructing a special image, where the nine special position values in the special image’s permuted image are the same as those in the cipher image. Then, if the obtained permuted image is chosen as plaintext, we can get its permuted image by attacking the diffusion process. Since the permutation process is reversible, the permuted image is the original plaintext image. In addition, some improvements for Li’s encryption scheme are provided to enhance the security.