Skip to content
Sign in
8.8 High

CVE-2026-101147 The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress…

Description

The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.

Affected products and versions

Product Affected versions Fixed in
Featured Image from URL (FIFU) 6.0 6.0.0 → < 6.0.8 6.0.8
Featured Image from URL (FIFU) Premium 6.8 6.8.0 → < 8.2.8 8.2.8

Other CVEs of Featured Image from URL (FIFU)

The 3 CVEs of Featured Image from URL (FIFU) →
CVE-2022-2278 The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its… Not rated CVE-2022-2241 The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its… Not rated
Track this CVE