PT-2025-51468 · WordPress · Fancy Product Designer

Muhammad Zeeshan · Published 2025-12-16 · Updated 2025-12-17 · CVE-2025-13231

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Fancy Product Designer versions prior to 6.4.9

Description The software is susceptible to a Server-Side Request Forgery (SSRF) issue. This is caused by a time-of-check/time-of-use (TOCTOU) race condition within the 'url' parameter of the fpd custom uplod file AJAX action. The validation process uses getimagesize() followed by file get contents() on the same URL, creating a timing gap that allows attackers to redirect requests to arbitrary internal or external URLs.

Recommendations Update The Fancy Product Designer plugin to version 6.4.9 or later.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2025-13231

Affected Products

Fancy Product Designer

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13231 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c56ec6ae-5b75-4cbb-aedd-f318fddc7bf0?source=cve · Note
• https://t.me/cveNotify/145911 · Telegram Post
• https://t.me/cveNotify/145914 · Telegram Post
• https://twitter.com/CVEnew/status/2001350877450559519 · Twitter Post
• https://support.fancyproductdesigner.com/support/discussions/topics/13000036024 · Note
• https://t.me/CVEtracker/39927 · Telegram Post