5.9
Moyenne
CVE-2025-13439 The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in…
Description
The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Fancy Product Designer 6.4 | premières → 6.4.8 | Pas de correctif indiqué |
Autres CVE de Fancy Product Designer
Les 11 CVE de Fancy Product Designer →
CVE-2026-84280
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order…
7.2
Élevée
CVE-2026-84279
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format'…
7.2
Élevée
CVE-2026-84281
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in…
7.2
Élevée
CVE-2025-15526
The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and…
5.3
Moyenne