CVE-2025-13393
MEDIUM EPSS 12.6%
Published Jan 10, 20265mo ago · Modified Jun 17, 20262w ago
4.3 CVSS 3.1
Published Jan 10, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago
Description
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.3.1. This is due to insufficient validation of user-supplied URLs before passing them to the getimagesize() function in the Elementor widget integration. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via the fifu_input_url parameter in the FIFU Elementor widget granted they have permissions to use Elementor.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
12.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-918 Server-Side Request Forgery (SSRF) Validation
References 5
- plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/elementor/widgets/widget.php#L121
- plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/elementor/widgets/widget.php#L94
- plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3428744/
- research.cleantalk.org https://research.cleantalk.org/cve-2025-13393/
- wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/b7115070-b84d-4d69-993a-f512b9f9c081?source=cve
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.