MEDIUM
Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure
Published Sep 26, 2025
5.3
MEDIUMCVSS 3.1
EPSS 0.29%
Description
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_posts() function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protected posts.
Affected products
-
Affected
- ≥ 0, ≤ 5.2.7
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Marceljm | Featured Image from URL (FIFU) | unaffected | Affected
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (4)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31213 Advisory
- https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/admin/debug.php?rev=3348285
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362830%40featured-image-from-url&new=3362830%40featured-image-from-url&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9423858b-74be-4b34-961d-97765d8edcbf?source=cve
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Wordfence
Published Sep 26, 2025
Updated Apr 8, 2026
Reserved Sep 4, 2025
Link CVE-2025-9984
CISA Vulnrichment
Updated Sep 26, 2025
Red Hat
No data
GitHub
No data