WordPress Featured Image from URL (FIFU) Premium plugin 6.8.0-8.2.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU Premium versions 6.8.0-8.2.7...

EUVD-2026-90506

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

PT-2026-103693

Name of the Vulnerable Software and Affected Versions Featured Image from URL FIFU WordPress plugin versions prior to 6.0.8 Featured Image from URL FIFU Premium WordPress plugin versions prior to 8.2.8 Description Cross-Site Request Forgery CSRF occurs because the software fails to correctly...