Server-Side Request Forgery Vulnerability in Featured Image Plus Plugin for WordPress

CVE-2025-5818

What is CVE-2025-5818?

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is susceptible to a Server-Side Request Forgery (SSRF) flaw. This vulnerability affects all versions up to and including 1.6.4 and arises from the fip_get_image_options() function. Authenticated users with administrator-level access can exploit this vulnerability to initiate web requests to arbitrary endpoints, thereby enabling potential queries and modifications to internal services. This could lead to serious security breaches, allowing attackers to access sensitive information or manipulate system resources.

References