CVE-2025-9985

Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File

Published Sep 26, 2025 CVSS 3.1 · 5.3 Medium EPSS 13.3% KEV · Not listed

Description

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.

Analysis

Technical impact

The Featured Image from URL plugin for WordPress is vulnerable to sensitive information exposure through publicly exposed log files in all versions up to and including 5.2.7. The weakness, identified as CWE-532, permits unauthenticated attackers to read potentially confidential data that is written to these logs. The exposure occurs because the plugin writes log information to a location that is accessible via the web, allowing attackers to retrieve the logs without authentication.

Affected Systems

All installations of the marceljm Featured Image from URL (FIFU) plugin with a version of 5.2.7 or earlier are affected. WordPress sites that have not upgraded past this version are at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of 11% indicates a moderate probability of exploitation. Because the vulnerability is not listed in the CISA KEV catalog, there is no evidence of widespread exploitation. The attack vector is straightforward: an unauthenticated user can access the exposed log files if the server allows public access to them.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

marceljm

Featured Image from URL (FIFU)

unaffected

Version	Status	Constraints
`0`	affected	≤ 5.2.7

No data.

Vendor	Product	Versions
Fifu	Featured Image From Url	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Featured Image from URL plugin to the latest version that removes or protects the exposed log files.
Configure web server or WordPress to restrict direct access to any log files, for example by using .htaccess rules or equivalent access control mechanisms.
Ensure that all log files are stored outside the web root or are set to permissions that prevent public read access.

Generated by OpenCVE AI on June 18, 2026 at 06:17 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-31212	The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 13.3% (13.282% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/admin/log.php?rev=3344903
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362830%40featured-image-from-url&new=3362830%40featured-image-from-url&sfp_email=&sfph_mail=#file6
https://www.wordfence.com/threat-intel/vulnerabilities/id/991d63da-ca6c-400e-beb7-b44cf629abc9?source=cve

History

Sep 26, 2025 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 26, 2025 11:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Fifu Fifu featured Image From Url Wordpress Wordpress wordpress
Vendors & Products		Fifu Fifu featured Image From Url Wordpress Wordpress wordpress

Sep 26, 2025 4:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.
Title		Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
Weaknesses		CWE-532
References		https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/admin/log.php?rev=3344903 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362830%40featured-image-from-url&new=3362830%40featured-image-from-url&sfp_email=&sfph_mail=#file6 https://www.wordfence.com/threat-intel/vulnerabilities/id/991d63da-ca6c-400e-beb7-b44cf629abc9?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`