CVE-2025-13231
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 6.4.8 due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_custom_uplod_file AJAX action. The plugin validates the URL by calling getimagesize() first, then later retrieves the same URL using file_get_contents(). This allows unauthenticated attackers to exploit the timing gap to perform SSRF attacks by serving a valid image during validation, then changing the response to redirect to arbitrary internal or external URLs during the actual fetch.
Risk Assessment
An attacker may access internal network resources, potentially leading to disclosure of sensitive information or attacks on other internal systems.
Recommendation
Update the plugin to the latest version if available, and consider implementing restrictions on access to internal IP addresses and ports.
Other vulnerabilities in Fancy Product Designer
See all- CVE-2026-84280High
The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2) is vulnerable to stored cross-site scripting via the 'elements[].title' parameter in shortcode orders due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. The injected payload is written to the DOM via innerHTML within the beforeElementAdd JavaScript event handler when processing the elements[].title field from the stored order JSON, meaning execution occurs specifically when an administrator reviews shortcode orders in the WordPress admin panel.
- CVE-2026-84281High
The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2) is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta. The fpd_save_order AJAX action is registered for unauthenticated users without nonce or capability checks, and the strip_tags() sanitization is bypassed using JSON unicode escape sequences that json_decode() converts back to angle brackets when the order is rendered in the admin view.
- CVE-2026-84279High
The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2) is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This requires the Pro Export/Genius feature to be enabled, as the vulnerable fpd_pr_export AJAX action is only registered when that feature is active.
- CVE-2025-13439Medium
The Fancy Product Designer plugin for WordPress in all versions up to and including 6.4.8 is vulnerable to Information Disclosure and PHAR Deserialization due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This allows unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.
Original NVD description (English source)
The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_custom_uplod_file AJAX action. The plugin validates the URL by calling getimagesize() first, then later retrieves the same URL using file_get_contents(). This makes it possible for unauthenticated attackers to exploit the timing gap to perform SSRF attacks by serving a valid image during validation, then changing the response to redirect to arbitrary internal or external URLs during the actual fetch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS