← Back to the live CVE advisory feed

CVE-2026-101147: Featured Image from URL (FIFU)

Severity

8.8 (HIGH)

Affected versions

6.0.0 through before 6.0.8; 6.8.0 through before 8.2.8

Fixed version

6.0.8

Patch status

Patched

Published

2026-10-01T06:17:01.790

Modified

2026-10-01T13:11:52.923

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.

View the official NVD record for CVE-2026-101147

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.