Server-Side Request Forgery Vulnerability in Featured Image from URL Plugin for WordPress

CVE-2025-13393

What is CVE-2025-13393?

The Featured Image from URL (FIFU) plugin for WordPress is susceptible to Server-Side Request Forgery due to inadequate validation of URLs provided by users. This vulnerability exists in all versions up to and including 5.3.1 and exploits a weakness in the integration with the Elementor widget. Authenticated attackers possessing Contributor-level access can leverage this flaw to conduct web requests to arbitrary locations, potentially compromising internal services by manipulating the fifu_input_url parameter within the FIFU Elementor widget.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References