CVE-2025-13231

Description

The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_custom_uplod_file AJAX action. The plugin validates the URL by calling getimagesize() first, then later retrieves the same URL using file_get_contents(). This makes it possible for unauthenticated attackers to exploit the timing gap to perform SSRF attacks by serving a valid image during validation, then changing the response to redirect to arbitrary internal or external URLs during the actual fetch.

PUBLISHED Reserved 2025-11-15 | Published 2025-12-16 | Updated 2025-12-16 | Assigner Wordfence

Problem types

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Product status

Timeline

Credits

Muhammad Zeeshan finder

References

www.wordfence.com/...-5b75-4cbb-aedd-f318fddc7bf0?source=cve

support.fancyproductdesigner.com/...sions/topics/13000036024

cve.org (CVE-2025-13231)

nvd.nist.gov (CVE-2025-13231)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.