What the vulnerability does
01Description
The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.
Explanation of Vulnerability in Simple Terms
02Summary
Fancy Product Designer versions 6.4.8 and earlier expose sensitive information to unauthenticated attackers over the network. The vulnerability requires specific conditions to exploit but does not require user interaction. An attacker can read data they should not have access to, though they cannot modify or disable the site. Update to a version newer than 6.4.8.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the site without authentication.
Potential impact on your site
04Site Impact
Confidential data may be exposed to unauthorized parties; no data modification or service disruption.
Conditions required to exploit
05Prerequisites
Network access; specific conditions must be met to trigger the vulnerability.
Key dates
06Disclosure timeline
December 16, 2025
CVE published
April 8, 2026
Record updated
