CVE-2026-96671

HighCVSS 8.8

Published: 09/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

A Cross-Site Request Forgery (CSRF) vulnerability in the Featured Image from URL plugin for WordPress, affecting versions up to 6.0.7, allows an attacker to force a logged-in user to perform unauthorized actions.

Risk Assessment

An attacker can trick an administrator into performing unwanted actions, such as changing settings or deleting data, without their consent.

Recommendation

Update the Featured Image from URL plugin to a version newer than 6.0.7 that includes the CSRF fix.

Other vulnerabilities in Featured Image from URL

CVE-2026-73340Medium
Contributor-level Cross Site Scripting (XSS) vulnerability in Featured Image from URL plugin versions up to and including 5.3.3.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS