CVE-2025-9985CWE-532

CVE-2025-9985

Medium · published September 26, 2025

CVSS v3.1

5.3

EPSS

12%

Percentile

96.2

In the wild

Unconfirmed

What it is

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.12310 · 96.2th percentile
Weakness: CWE-532 · Insertion of Sensitive Information into Log File
Published: 2025-09-26T09:15Z

References (3)

https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/admin/log.php?rev=3344903 · [email protected]https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362830%40featured-image-from-url&new=3362830%40featured-image-from-url&sfp_email=&sfph_mail=#file6 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/991d63da-ca6c-400e-beb7-b44cf629abc9?source=cve · [email protected]

EPSS history

Timeline

26 SEP 04:25Z
Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
cvelistv5