PT-2025-51468 · WordPress · Fancy Product Designer

Muhammad Zeeshan · Publicado 2025-12-16 · Atualizado 2025-12-17 · CVE-2025-13231

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Fancy Product Designer versions prior to 6.4.9

Description The software is susceptible to a Server-Side Request Forgery (SSRF) issue. This is caused by a time-of-check/time-of-use (TOCTOU) race condition within the 'url' parameter of the fpd custom uplod file AJAX action. The validation process uses getimagesize() followed by file get contents() on the same URL, creating a timing gap that allows attackers to redirect requests to arbitrary internal or external URLs.

Recommendations Update The Fancy Product Designer plugin to version 6.4.9 or later.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2025-13231

Produtos afetados

Fancy Product Designer

Referências · 7

• https://wordfence.com/threat-intel/vulnerabilities/id/c56ec6ae-5b75-4cbb-aedd-f318fddc7bf0?source=cve · Nota
• https://t.me/cveNotify/145911 · Publicação no Telegram
• https://t.me/cveNotify/145914 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2001350877450559519 · Publicação no Twitter
• https://support.fancyproductdesigner.com/support/discussions/topics/13000036024 · Nota
• https://t.me/CVEtracker/39927 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-13231 · Nota de Segurança