CVE-2025-5818 | THREATINT

Description

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.4 via the fip_get_image_options() function. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Reserved 2025-06-06 | Published 2025-07-23 | Updated 2025-07-23 | Assigner Wordfence

MEDIUM: 5.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Problem types

CWE-918 Server-Side Request Forgery (SSRF)

Product status

Default status

unaffected

affected

Timeline

2025-07-22:

Disclosed

Credits

ch4r0n finder

References

www.wordfence.com/...-e06f-4f17-905b-a943a39dfbdb?source=cve

plugins.trac.wordpress.org/...ditor/block-editor-actions.php

cve.org (CVE-2025-5818)

nvd.nist.gov (CVE-2025-5818)

Download JSON