Information Disclosure Vulnerability in Fancy Product Designer Plugin for WordPress

CVE-2025-13439

What is CVE-2025-13439?

The Fancy Product Designer plugin for WordPress is susceptible to an information disclosure vulnerability due to inadequate validation of user-input within the 'url' parameter of the fpd_custom_upload_file AJAX action. This vulnerability permits unauthenticated attackers to potentially access sensitive files, including the configuration file wp-config.php, by exploiting the getimagesize() function without proper sanitization. Although PHP 8+ mitigates direct exploitation via PHP filter chains, risks remain in PHP 7.x environments and can be exacerbated by a time-of-check to time-of-use (TOCTOU) race condition, which is also an identified issue within this plugin.

References