CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_posts() function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protected posts.
Explanation of Vulnerability in Simple Terms
The Featured Image from URL plugin for WordPress contains an authorization flaw that allows unauthenticated attackers to read sensitive image metadata and file information. The vulnerability exists in versions up to 5.2.7 and requires no user interaction. An attacker can enumerate or access image details without proper permission checks.
What an attacker can do
Read image metadata and file information without authentication.
Potential impact on your site
Attackers can discover and access image file paths and metadata, potentially exposing sensitive image information.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
