CVE-2025-9984: WordPress FIFU Plugin Info Disclosure Flaw

CVE-2025-9984 Overview

CVE-2025-9984 is a missing authorization vulnerability in the Featured Image from URL (FIFU) plugin for WordPress. The flaw exists in the fifu_api_debug_posts() function and affects all versions up to and including 5.2.7. The function lacks a capability check, allowing unauthenticated attackers to invoke it over the network. Successful exploitation exposes the contents of private and password-protected posts to anonymous users. The weakness is categorized as [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated attackers can read private and password-protected WordPress posts by calling an unauthenticated REST endpoint exposed by the FIFU plugin.

Affected Products

Featured Image from URL (FIFU) plugin for WordPress, versions up to and including 5.2.7
WordPress installations that have the FIFU plugin activated
Sites relying on WordPress private or password-protected post visibility for confidentiality

Discovery Timeline

2025-09-26 - CVE-2025-9984 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9984

Vulnerability Analysis

The FIFU plugin registers a debug endpoint that returns post data through the fifu_api_debug_posts() function. The function processes requests without verifying that the caller holds an administrative capability such as manage_options. Because WordPress REST routes are reachable over the network without authentication by default, any remote client can request the endpoint and receive post content that WordPress would normally restrict. Confidentiality is impacted, but integrity and availability are not, since the function only reads and returns data. The exposed data can include drafts, private posts, and posts protected by a password, undermining editorial workflows and paywalled content controls.

Root Cause

The root cause is a missing capability check within fifu_api_debug_posts(). The function was intended to assist site administrators with diagnostics but did not enforce current_user_can() or an equivalent permission callback on the REST route. WordPress therefore treats the request as authorized regardless of the caller's identity.

Attack Vector

An unauthenticated attacker sends an HTTP request to the FIFU debug REST endpoint on a vulnerable WordPress site. The server executes the debug function, queries posts including those with non-public status, and returns the results in the response body. No user interaction, credentials, or elevated privileges are required. The vulnerability mechanism is documented in the WordPress Plugin Debug File and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-9984

Indicators of Compromise

HTTP requests to WordPress REST routes referencing the FIFU debug endpoint from unauthenticated clients
Access log entries showing repeated requests to /wp-json/ paths tied to the featured-image-from-url plugin
Responses returning post identifiers or content for posts marked private or password-protected

Detection Strategies

Inventory WordPress sites and identify installations running FIFU at or below version 5.2.7
Review web server and WordPress access logs for calls to FIFU debug REST routes from unauthenticated sources
Correlate outbound response sizes on FIFU endpoints with attempts to enumerate posts

Monitoring Recommendations

Alert on anonymous requests to /wp-json/fifu/* and similar plugin-registered REST namespaces
Track the FIFU plugin version across all managed WordPress instances and flag versions ≤ 5.2.7
Monitor for unusual read volumes against private post identifiers via database or application telemetry

How to Mitigate CVE-2025-9984

Immediate Actions Required

Update the Featured Image from URL (FIFU) plugin to a version later than 5.2.7 on every WordPress site
Audit private and password-protected posts for potential exposure since the vulnerable version was installed
Restrict access to /wp-json/ endpoints at the web application firewall until patching is confirmed

Patch Information

The plugin author addressed the missing capability check in the plugin repository. See the WordPress Plugin Changeset for the code change and upgrade to the fixed release available through the WordPress plugin directory.

Workarounds

Deactivate and remove the FIFU plugin until it can be updated to a fixed version
Block requests to the FIFU debug REST route at a reverse proxy or web application firewall
Rotate passwords on password-protected posts that may have been exposed prior to remediation

bash

# Configuration example: block the FIFU debug REST route at the web server
# nginx snippet
location ~* /wp-json/fifu/.*/debug {
    deny all;
    return 403;
}