PT-2025-39498 · WordPress · Featured Image From Url

Ifoundbug · Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-9984

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Featured Image from URL (FIFU) plugin for WordPress versions through 5.2.7

Description The plugin is susceptible to unauthorized data access because of a missing capability check within the fifu api debug posts() function. This allows unauthenticated attackers to read private or password-protected posts. The issue involves the fifu api debug posts() function, which lacks proper authorization controls.

Recommendations Update to version 5.2.8 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-9984

Affected Products

Featured Image From Url

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-9984 · Security Note
• https://t.me/CVEtracker/33422 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9423858b-74be-4b34-961d-97765d8edcbf?source=cve · Note
• https://twitter.com/CVEnew/status/1971437492378255501 · Twitter Post
• https://t.me/cveNotify/136493 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971466094767428053 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362830%40featured-image-from-url&new=3362830%40featured-image-from-url&sfp_email=&sfph_mail= · Note
• https://twitter.com/VolerionSec/status/1971445095569240263 · Twitter Post
• https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/admin/debug.php?rev=3348285 · Note