5.9
Medium
CVE-2025-13439 The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in…
Description
The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fancy Product Designer 6.4 | earliest → 6.4.8 | No fix stated |
Other CVEs of Fancy Product Designer
The 11 CVEs of Fancy Product Designer →
CVE-2026-84280
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order…
7.2
High
CVE-2026-84279
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format'…
7.2
High
CVE-2026-84281
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in…
7.2
High
CVE-2025-15526
The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and…
5.3
Medium