The Featured Image from URL plugin for WordPress is vulnerable to sensitive information exposure through publicly exposed log files in all versions up to and including 5.2.7. The weakness, identified as CWE-532, permits unauthenticated attackers to read potentially confidential data that is written to these logs. The exposure occurs because the plugin writes log information to a location that is accessible via the web, allowing attackers to retrieve the logs without authentication.

All installations of the marceljm Featured Image from URL (FIFU) plugin with a version of 5.2.7 or earlier are affected. WordPress sites that have not upgraded past this version are at risk.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of 2% suggests low but non‑zero likelihood of exploitation. Because the vulnerability is not listed in the CISA KEV catalog, there is no evidence of widespread exploitation. The attack vector is straightforward: an unauthenticated user can access the exposed log files if the server allows public access to them.