CVE-2025-10037: WordPress FIFU Plugin SQL Injection Flaw

CVE-2025-10037 Overview

CVE-2025-10037 is a SQL Injection vulnerability in the Featured Image from URL (FIFU) plugin for WordPress. The flaw exists in the get_posts_with_internal_featured_image() function and affects all versions up to and including 5.2.7. The root cause is insufficient escaping of a user-supplied parameter combined with a lack of proper query preparation. Authenticated attackers holding Administrator or higher privileges can append additional SQL statements to existing queries and extract sensitive data from the WordPress database. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated administrators can execute arbitrary SQL against the WordPress database, exposing user credentials, session tokens, and site secrets stored in wp_options.

Affected Products

Featured Image from URL (FIFU) WordPress plugin versions ≤ 5.2.7
WordPress installations with FIFU plugin enabled
Any multi-admin WordPress environment relying on FIFU for external featured images

Discovery Timeline

2025-09-26 - CVE-2025-10037 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10037

Vulnerability Analysis

The vulnerability resides in the get_posts_with_internal_featured_image() function within the FIFU plugin's admin/db.php file. The function accepts a user-controlled parameter and concatenates it into a SQL query without invoking WordPress's $wpdb->prepare() helper or applying sufficient escaping. As a result, attacker-supplied input is interpreted as SQL syntax rather than as a literal value. Because the underlying query is executed directly against the WordPress database, an attacker can append UNION SELECT payloads or stacked expressions to exfiltrate arbitrary tables and columns. Exploitation requires an authenticated session with Administrator-level access, which limits the attacker population but does not remove the risk in shared or delegated administration models.

Root Cause

The root cause is a failure to parameterize a dynamic SQL statement. WordPress provides the $wpdb->prepare() API to bind user input safely, but the affected function omitted this call and did not apply esc_sql() or numeric casting to the parameter. Attacker-supplied metadata is placed directly into the query string, allowing SQL syntax to break out of the intended clause.

Attack Vector

An authenticated administrator submits a request to a plugin endpoint that invokes get_posts_with_internal_featured_image(). The attacker supplies a crafted parameter containing SQL metacharacters. The malicious fragment is appended to the underlying query and executed by the database engine, returning attacker-selected rows in the response or via inferential techniques such as time-based blind SQLi.

// No verified proof-of-concept code is published for CVE-2025-10037.
// Refer to the Wordfence advisory and the WordPress plugin repository
// changeset for technical details on the vulnerable code path and the fix.
// Advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/54c1b0e9-6fab-4452-b232-953e671f4d8d
// Source:   https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/admin/db.php?rev=3348285

Detection Methods for CVE-2025-10037

Indicators of Compromise

Unexpected UNION SELECT, SLEEP(, BENCHMARK(, or INFORMATION_SCHEMA substrings in web server access logs targeting FIFU admin endpoints.
WordPress database queries originating from admin/db.php containing unusually long or encoded parameter values.
New or unexpected reads against wp_users, wp_usermeta, or wp_options from administrator sessions that do not normally access these tables.
Outbound data transfers from the WordPress host following administrator activity on FIFU pages.

Detection Strategies

Enable WordPress query logging or MySQL general query logging and alert on statements referencing FIFU functions with SQL keywords in parameters.
Deploy a web application firewall rule that inspects requests to /wp-admin/ endpoints associated with the FIFU plugin for SQL metacharacters.
Correlate administrator login events with subsequent anomalous database read volume against sensitive tables.

Monitoring Recommendations

Audit all accounts holding the administrator role and enforce least privilege for content editors who only need image management.
Monitor the Wordfence Vulnerability Report feed for updates and related indicators.
Track plugin version drift across WordPress fleets to identify hosts still running FIFU ≤ 5.2.7.

How to Mitigate CVE-2025-10037

Immediate Actions Required

Update the Featured Image from URL plugin to a version later than 5.2.7 that contains the fix committed in changeset 3362830.
Review the administrator account inventory and remove or downgrade unused privileged accounts.
Rotate WordPress secrets in wp-config.php and reset administrator passwords if compromise is suspected.

Patch Information

The FIFU maintainers addressed the SQL Injection by adding proper query preparation to get_posts_with_internal_featured_image(). The corrective code is visible in the plugin repository via the WordPress Plugin DB Script and the referenced changeset. Administrators should upgrade through the WordPress plugin update mechanism.

Workarounds

Temporarily deactivate the Featured Image from URL plugin until the patched version can be deployed.
Restrict administrative access with network-level controls or IP allow lists on /wp-admin/.
Enforce multi-factor authentication for all WordPress administrator accounts to raise the cost of the required privileged foothold.

bash

# Update the FIFU plugin using WP-CLI
wp plugin update featured-image-from-url

# Verify the installed version is greater than 5.2.7
wp plugin get featured-image-from-url --field=version

# If patching is delayed, deactivate the plugin
wp plugin deactivate featured-image-from-url