CVE-2026-101147: FIFU WordPress Plugin CSRF Vulnerability

CVE-2026-101147 Overview

CVE-2026-101147 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Featured Image from URL (FIFU) WordPress plugin. The flaw exists in versions before 6.0.8 of the free plugin and before 8.2.8 of the Premium plugin. The plugin fails to correctly enforce the REST API nonce, disabling the check for the entire request when a crafted URL is used. Attackers can leverage this weakness to trick a logged-in administrator into performing arbitrary REST API actions, including creating a new administrator account. Exploitation requires the victim administrator to visit an attacker-controlled page while authenticated to the target WordPress site.

Critical Impact
Successful exploitation allows unauthenticated attackers to achieve full site takeover by creating rogue administrator accounts through a victim's browser.

Affected Products

Featured Image from URL (FIFU) WordPress plugin before 6.0.8
Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8
WordPress sites running vulnerable FIFU plugin versions with authenticated administrator sessions

Discovery Timeline

2026-10-01 - CVE-2026-101147 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-101147

Vulnerability Analysis

The vulnerability resides in how the FIFU plugin handles REST API nonce verification. WordPress uses nonces as a CSRF countermeasure, requiring state-changing REST API requests to include a valid, user-bound token. The FIFU plugin registers logic that disables the nonce check for the entire request when a specially crafted URL parameter is present. This design flaw converts an authenticated REST endpoint into one that can be invoked across origins without a valid token. An attacker hosting a malicious page can trigger privileged REST API calls through the victim administrator's browser session.

Root Cause

The root cause is improper enforcement of REST API nonce validation [CWE-352]. Instead of validating the nonce on a per-endpoint basis, the plugin exposes a code path that short-circuits nonce verification for the whole request when the attacker-controlled URL pattern is matched. This defeats WordPress's built-in CSRF protection for any REST route reachable during that request lifecycle.

Attack Vector

Exploitation requires an authenticated WordPress administrator to visit an attacker-controlled web page or click a crafted link. The malicious page issues a cross-origin request to the target WordPress REST API that includes the URL pattern triggering the nonce bypass. Because the administrator's browser automatically attaches session cookies, the server processes the request with full administrative privileges. An attacker can create a new administrator account, modify plugin settings, publish content, or invoke any REST route available to administrators. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-101147

Indicators of Compromise

Unexpected administrator accounts created in wp_users with recent registration timestamps
REST API requests to /wp-json/ endpoints originating from external Referer headers
Access log entries containing the crafted URL pattern associated with the FIFU nonce bypass
Modifications to plugin or theme files, or new plugin installations, correlated with administrator session activity

Detection Strategies

Audit WordPress user tables for unauthorized accounts with the administrator role and review user_registered timestamps
Inspect web server access logs for POST requests to FIFU REST endpoints with suspicious cross-origin referers
Compare installed FIFU plugin version against the fixed versions (6.0.8 and 8.2.8) across managed WordPress sites

Monitoring Recommendations

Forward WordPress and web server logs to a centralized log platform for correlation with authentication events
Alert on REST API calls to wp/v2/users with POST method where the role parameter equals administrator
Monitor outbound requests from administrator browsers to unknown domains that precede WordPress state changes

How to Mitigate CVE-2026-101147

Immediate Actions Required

Update the Featured Image from URL (FIFU) plugin to version 6.0.8 or later
Update the FIFU Premium plugin to version 8.2.8 or later
Review all WordPress administrator accounts and remove any that are unauthorized
Rotate credentials and force reauthentication for all administrator accounts after patching

Patch Information

The vendor addressed the issue in FIFU 6.0.8 and FIFU Premium 8.2.8 by correctly enforcing REST API nonce validation. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI. Refer to the WPScan Vulnerability Report for upstream patch references.

Workarounds

Deactivate and remove the FIFU plugin until the patched version can be installed
Restrict administrator access to the WordPress dashboard using IP allowlisting at the web server or WAF layer
Require administrators to use a dedicated browser or profile when accessing WordPress to reduce CSRF exposure
Deploy a web application firewall rule that blocks REST API requests with the crafted URL pattern described in the WPScan advisory

bash

# Update FIFU plugin to the patched version using WP-CLI
wp plugin update featured-image-from-url --version=6.0.8
wp plugin list --name=featured-image-from-url --fields=name,status,version