CVE-2025-9984

MediumCVSS 5.3

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

The Featured Image from URL (FIFU) plugin for WordPress up to version 5.2.7 lacks a capability check on the fifu_api_debug_posts() function, allowing unauthenticated attackers to read private and password-protected posts.

Risk Assessment

Unauthorized access to private content can expose sensitive information, compromising data confidentiality and user trust.

Recommendation

Update the FIFU plugin to the latest patched version. Restrict access to the debug API if possible.

Other vulnerabilities in Featured Image from URL (FIFU)

CVE-2025-7400Medium
The Featured Image from URL (FIFU) plugin for WordPress up to version 5.2.7 is vulnerable to Stored Cross-Site Scripting (XSS) via a post's Featured Image custom fields due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 5.2.2.

Original NVD description (English source)

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_posts() function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protected posts.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS