The Featured Image from URL plugin contains a SQL Injection flaw in the get_all_urls() function. Unsanitized user input is concatenated into a database query, and without proper preparation the attacker can embed additional SQL statements. The vulnerability is exploitable only by users who already have Administrator privileges or higher, allowing the injection of arbitrary queries that can read sensitive data from the database, thereby compromising confidentiality.

WordPress sites running the marceljm Featured Image from URL plugin version 5.2.7 or earlier are vulnerable. The issue is present in every release up to and including 5.2.7. Users should verify that the plugin is upgraded beyond this version or removed entirely.

The CVSS score of 4.9 indicates a moderate impact, but the exploit probability indicated by EPSS being less than 1% suggests low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated administrator access, the attack vector is limited to privileged accounts; an attacker would need to compromise or hijack an admin account to leverage the injection vector.