PT-2025-51377 · WordPress · Fancy Product Designer

Muhammad Zeeshan · Published 2025-12-16 · Updated 2026-01-22 · CVE-2025-13439

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fancy Product Designer plugin for WordPress versions prior to 6.4.9

Description The software contains a flaw due to inadequate validation of user-provided input in the url parameter of the 'fpd custom uplod file' AJAX action. This input is directly passed to the getimagesize() function without proper sanitization. While exploitation via PHP filter chains is restricted on PHP 8 and later versions, the issue can be exploited through a TOCTOU race condition or may be directly exploitable on PHP 7.x installations. This allows unauthenticated attackers to read arbitrary sensitive files from the server, such as wp-config.php.

Recommendations Update Fancy Product Designer plugin to version 6.4.9 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-13439

Affected Products

Fancy Product Designer

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13439 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4fd6df9d-2963-44b1-bc4e-e53eda97a2a9?source=cve · Note
• https://twitter.com/CVEnew/status/2001365821700858023 · Twitter Post
• https://t.me/cveNotify/149504 · Telegram Post
• https://t.me/cveNotify/145911 · Telegram Post
• https://t.me/CVEtracker/39927 · Telegram Post
• https://support.fancyproductdesigner.com/support/discussions/topics/13000036024 · Note