Fancy Product Designer CVE-2025-13439
MEDIUMSeverity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable AJAX action (AV:N/PR:N/UI:N) yielding sensitive file disclosure (C:H); AC:H because reliable file-read/PHAR triggering depends on server-side conditions, with no integrity/availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.
AnalysisAI
Unauthenticated information disclosure in the Fancy Product Designer WordPress plugin (all versions up to and including 6.4.8) lets remote attackers read arbitrary files on the server, including wp-config.php, by supplying a crafted 'url' value to the plugin's fpd_custom_uplod_file AJAX action, which passes that value unsanitized into PHP's getimagesize(); the same code path can be abused for PHAR deserialization where a reachable phar archive and a usable PHP object gadget chain exist. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, 5.9) confirms no credentials and no user interaction are required, but high attack complexity reflects server-specific preconditions, and impact is confined to confidentiality with no integrity or availability effect. There is no CISA KEV entry and no public exploit code identified at time of analysis, and EPSS is low at 0.31% (22nd percentile), so this is a moderate-priority exposure rather than an emergency patching event.
Technical ContextAI
Fancy Product Designer is a WordPress plugin that registers custom AJAX handlers, including the fpd_custom_uplod_file action, which is reachable without authentication through wp-admin/admin-ajax.php via the plugin's nopriv AJAX registration. The root cause is CWE-200 (Exposure of Sensitive Information) arising from insufficient validation of user-supplied input: the 'url' parameter is handed directly to PHP's getimagesize() without sanitization or scheme allow-listing. Because getimagesize() honors PHP stream wrappers, an attacker can substitute file paths or wrapper-prefixed URLs, and the function's processing of the target yields file contents or file-existence/format signals that leak sensitive data such as database credentials in wp-config.php. The additional deserialization angle comes from the phar:// wrapper: when getimagesize() opens a phar archive, PHP unserializes its metadata, which can trigger magic methods (__wakeup, __destruct) on classes already loaded by WordPress and its plugins and themes - the classic PHAR deserialization primitive. That second stage is conditional, requiring an attacker-plantable or otherwise resolvable phar file plus a viable gadget chain in the installed codebase, which is why the independent assessment holds attack complexity high (AC:H) and scopes the demonstrated impact to file and credential disclosure with no direct integrity or availability loss per the CVSS vector. No CPE data was supplied, so affected product identification rests on the plugin's own versioning rather than an authoritative CPE string.
Affected ProductsAI
The affected product is the Fancy Product Designer plugin for WordPress, in all versions up to and including 6.4.8, regardless of the WordPress core or PHP version in use, as long as the plugin is installed and active. The vulnerable surface is the plugin's fpd_custom_uplod_file AJAX action, exposed through wp-admin/admin-ajax.php, and the exposure applies wherever that handler is registered, including sites that do not use the custom-product-upload feature interactively. No CPE strings were provided in the source data, so version confirmation must be done against the plugin's own header/readme; the vendor's discussion thread at https://support.fancyproductdesigner.com/support/discussions/topics/13000036024 and the Wordfence threat-intel entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd6df9d-2963-44b1-bc4e-e53eda97a2a9?source=cve are the authoritative references for the affected range and any corrected builds published after 6.4.8.
RemediationAI
No vendor-released patch version for this issue appears in the supplied data, so the first action is to check the vendor discussion at https://support.fancyproductdesigner.com/support/discussions/topics/13000036024 for an updated release and, if a fixed build newer than 6.4.8 is published, upgrade to it and verify the plugin version on every site in the estate; the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd6df9d-2963-44b1-bc4e-e53eda97a2a9?source=cve should be monitored for patch confirmation. Where the plugin is not essential, deactivate and remove it - this is the only mitigation that fully closes both the file-read and PHAR deserialization paths, and its trade-off is loss of the product designer functionality. If the plugin must stay installed, treat deletion as the goal and apply compensating controls in the interim: block or rate-limit POST requests to /wp-admin/admin-ajax.php where the action parameter is fpd_custom_uplod_file, using a WAF or an nginx/Apache rule (side effect: legitimate front-end custom uploads stop working, so validate against business use); reject any 'url' value containing a stream wrapper scheme such as phar://, file://, php://, or data:// at the edge (side effect: some legitimate upload flows that pass absolute paths may break); and harden the PHP runtime by setting open_basedir to the WordPress document root, disabling allow_url_fopen and allow_url_include where the theme and plugins tolerate it, and running PHP under an account that cannot read files outside the web root (side effect: some file-management and media plugins may fail). Because the vector is AC:H and no public exploit code has been identified, these measures map to moderate urgency, but they should be prioritized on any site where wp-config.php or other credential-bearing files share a filesystem with the web root, and the exposed credentials should be rotated if exploitation is suspected.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today