SQL Injection Vulnerability in Featured Image from URL Plugin for WordPress
CVE-2025-10037
4.9MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 September 2025
What is CVE-2025-10037?
The Featured Image from URL plugin for WordPress has a vulnerability that permits SQL Injection through the get_posts_with_internal_featured_image() function. This flaw exists due to inadequate escaping of user-supplied parameters and insufficient preparation of existing SQL queries. Authenticated attackers with Administrator-level access can exploit this issue to insert additional SQL commands into existing queries, potentially compromising the confidentiality of sensitive database information.
Affected Version(s)
Featured Image from URL (FIFU) * <= 5.2.7