The Featured Image from URL (FIFU) plugin for WordPress allows unauthenticated attackers to read private or password‑protected posts because a capability check is missing on the fifu_api_debug_posts() function. The primary impact is the unauthorized disclosure of content that should be protected by post visibility settings. This weakness is an authorization failure (CWE‑862).

WordPress sites running the Featured Image from URL (FIFU) plugin by marceljm with versions 5.2.7 or earlier. The vulnerability exists in all releases up to and including 5.2.7.

The CVSS score of 5.3 indicates medium severity, while the EPSS score of less than 1% suggests a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the vulnerable endpoint by sending a direct HTTP request to fifu_api_debug_posts() (often via /wp-admin/admin-ajax.php), bypassing any authentication checks and retrieving full post content. Although the risk is moderate, the lack of authorization allows public exposure of content that the site owner considers private, and the vulnerability remains actively exploitable until the plugin is updated.