PT-2025-39496 · WordPress · Featured Image From Url

Ifoundbug · Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-10036

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Featured Image from URL (FIFU) plugin for WordPress versions through 5.2.7

Description The Featured Image from URL (FIFU) plugin for WordPress is susceptible to SQL Injection through the get all urls() function. Insufficient escaping of user-supplied parameters and inadequate SQL query preparation contribute to this issue. Authenticated attackers with Administrator-level access or higher can inject additional SQL queries into existing queries, potentially extracting sensitive information from the database.

Recommendations Update the Featured Image from URL (FIFU) plugin to a version later than 5.2.7.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10036

Affected Products

Featured Image From Url

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-10036 · Security Note
• https://twitter.com/CVEnew/status/1971437490381692955 · Twitter Post
• https://t.me/cveNotify/136491 · Telegram Post
• https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/admin/api.php?rev=3348285 · Note
• https://twitter.com/VulmonFeeds/status/1971473774135431525 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362830%40featured-image-from-url&new=3362830%40featured-image-from-url&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ed54fe33-6467-4af2-ba28-dd17287d8f92?source=cve · Note
• https://t.me/CVEtracker/33420 · Telegram Post