The Fancy Product Designer plugin for WordPress is vulnerable to an unauthenticated information disclosure flaw that also allows PHAR deserialization. The issue originates from the 'url' parameter in the 'fpd_custom_uplod_file' AJAX action, which is passed directly into PHP’s getimagesize function without proper sanitization. Because the function reads image metadata, an attacker can cause the server to load arbitrary files, including the sensitive wp-config.php, resulting in exposure of database credentials and other secret data. This flaw does not grant code execution but offers attackers a path to read any file that the web server process can access.

All releases of the Fancy Product Designer plugin from the vendor radykal up to and including version 6.4.8 are affected. The vulnerability is present in WordPress installations that employ this plugin, allowing unauthenticated web users to trigger the vulnerable AJAX action and read server files. Any site running WordPress with 6.4.8 or earlier is therefore at risk, regardless of whether WooCommerce is also installed.

The flaw carries a CVSS score of 5.9, indicating a moderate risk severity. The EPSS score is listed as less than 1, implying that the likelihood of exploitation observed in the wild is low, and the issue is not currently catalogued in the CISA KEV list. Attackers can exploit the weakness by sending an unauthenticated HTTP request to the plugin’s AJAX endpoint with a crafted 'url' value, immediately retrieving the contents of arbitrary files without authentication. Because the vulnerability is reported as Data Exposure, the impact remains limited to confidentiality rather than integrity or availability.