Unauthorized Data Access in Featured Image from URL Plugin for WordPress
CVE-2025-9984
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 September 2025
What is CVE-2025-9984?
The Featured Image from URL (FIFU) plugin for WordPress is susceptible to unauthorized data access due to the absence of a capability check in the fifu_api_debug_posts() function. This vulnerability affects all versions up to and including 5.2.7, enabling unauthenticated attackers to gain access to private and password-protected posts, thereby compromising sensitive information.
Affected Version(s)
Featured Image from URL (FIFU) * <= 5.2.7