CVE-2025-9985

MEDIUM EXPLOITED NUCLEI

WordPress <5.2.7 - Info Disclosure

Title source: llm

Description

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.

Nuclei Templates (1)

Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File

MEDIUMVERIFIEDby zer0p0int

References (3)

[Product] https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/admin/log.php?rev=3344903

[Product] https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362830%40featured-image-from-url&new=3362830%40featured-image-from-url&sfp_email=&sfph_mail=#file6

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/991d63da-ca6c-400e-beb7-b44cf629abc9?source=cve

Scores

CVSS v3 5.3

EPSS 0.0331

EPSS Percentile 87.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

VulnCheck KEV 2025-11-27

CWE

CWE-532

Status published

Products (1)

marceljm/Featured Image from URL (FIFU) < 5.2.7

Published Sep 26, 2025

Tracked Since Feb 18, 2026