The Fancy Product Designer plugin for WordPress suffers from a time‑of‑check/time‑of‑use race condition in the fpd_custom_uplod_file AJAX action. During validation the plugin calls getimagesize() on the supplied URL, then later fetches the same URL with file_get_contents(). An unauthenticated attacker can exploit the timing window by serving a valid image during validation, then changing the response to redirect to an arbitrary internal or external URL during the actual fetch. This allows the attacker to make the server consider any specified URL, effectively enabling server‑side request forgery. The weakness represented is a classic race‑condition flaw (CWE‑362).

Affected vendor: radykal. Product: Fancy Product Designer plugin for WordPress. All releases up to and including 6.4.8 are vulnerable. No other vendors or products are affected based on the available data.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1 % suggests a low probability of current exploitation in the wild, though the vulnerability can be leveraged by any unauthenticated user. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers need only send a crafted AJAX request to the vulnerable endpoint; no prior authentication is required. If successfully exploited, the server can redirect to various internal or external destinations, potentially exposing sensitive internal networks or facilitating data exfiltration.