CVE-2025-5818
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2Description
The Featured Image Plus - Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.6 via the fip_get_image_options() function. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Analysis
Server-Side Request Forgery in Featured Image Plus - Quick & Bulk Edit with Unsplash WordPress plugin through version 1.6.6 allows authenticated administrators to make arbitrary web requests from the vulnerable server via the fip_get_image_options() function, potentially enabling reconnaissance and modification of internal services. No public exploit code or active CISA KEV confirmation documented; however, the vulnerability requires administrator-level access and presents a CVSS 5.5 score reflecting limited confidentiality and integrity impact.
Technical Context
The vulnerability exists in the fip_get_image_options() function within the block editor actions component (block-editor-actions.php, line 166) of the Featured Image Plus WordPress plugin. The underlying weakness is CWE-918 (Server-Side Request Forgery), which occurs when a web application fetches remote resources without properly validating or restricting the target URL. In this case, the plugin fails to sanitize or restrict the destination of web requests initiated on behalf of the server, allowing an authenticated attacker with administrator credentials to redirect those requests to internal network resources, local services (localhost), or external arbitrary hosts. This is particularly dangerous in WordPress multisite environments or shared hosting scenarios where SSRF can be chained with other vulnerabilities to pivot through network trust boundaries.
Affected Products
Featured Image Plus - Quick & Bulk Edit with Unsplash WordPress plugin versions up to and including 1.6.6. The plugin is distributed via the official WordPress Plugin Directory at plugins.trac.wordpress.org/browser/featured-image-plus. All installations running version 1.6.6 or earlier are vulnerable if any administrator accounts exist on the site.
Remediation
Update the Featured Image Plus plugin to version 1.6.7 or later immediately. The vendor has released a patched version (referenced in the changeset snapshot) that sanitizes and restricts the fip_get_image_options() function to prevent arbitrary URL specification. Administrators should navigate to WordPress Dashboard > Plugins > Featured Image Plus and click Update, or enable automatic updates for plugins. If immediate update is not possible, restrict administrator role membership to only trusted users and consider temporarily disabling the plugin if it is not actively in use. Refer to the Wordfence threat intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/6904f168-e06f-4f17-905b-a943a39dfbdb) for additional context and confirmation of patch availability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today