Fancy Product Designer CVE-2025-13231

Remote and unauthenticated (PR:N, UI:N) against default installations of the Fancy Product Designer WordPress plugin at versions ≤6.4.8, reachable via the 'fpd_custom_uplod_file' AJAX action. The concrete prerequisite is that the attacker must control a web server capable of serving differential responses - a valid image during the getimagesize() validation phase and then a changed response or redirect during the file_get_contents() fetch phase. The practical limiting factor is winning this TOCTOU timing window between the two server-side fetches; because the attacker controls both responses this is largely reliable, but it is not a single-shot payload. Impact is constrained to SSRF (reaching internal/external URLs), not code execution.

This is a moderate-priority SSRF (CVSS 6.5) rather than a critical emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) signals a network-reachable, unauthenticated flaw with no user interaction, which raises its baseline concern because any visitor can reach the vulnerable 'fpd_custom_uplod_file' AJAX action. However, the real-world risk is tempered by the exploitation mechanism: as a CWE-362 TOCTOU race condition, success depends on the attacker operating a malicious server that returns a valid image to getimagesize() and then a different/redirecting response to the subsequent file_get_contents() call - a conditional-but-controllable window. Impact is bounded (C:L/I:L/A:N): SSRF here yields limited internal reachability, not direct RCE or full data disclosure. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a tension worth flagging: the provided vector uses AC:L, but a race-condition root cause (CWE-362) typically warrants AC:H - the attacker's control over both server responses makes the race largely winnable, so AC:L is defensible but borderline; verify against the Wordfence advisory. Net: patch in normal cadence; it is not a high-CVSS-but-meaningless issue, but neither is it a drop-everything item absent exploitation signals.

An unauthenticated attacker hosts a web server under their control and submits its URL to the plugin's fpd_custom_uplod_file AJAX endpoint; the server returns a valid image so the getimagesize() validation passes, then on the follow-up file_get_contents() fetch it returns a redirect to an internal resource (e.g., a cloud metadata endpoint or an internal-only service). This lets the attacker coerce the WordPress server into making requests to otherwise unreachable internal or external URLs. No public exploit was identified at time of analysis.