FIFU WordPress Plugin EUVD-2026-90506

Exploitation requires a vulnerable version installed (Featured Image from URL before 6.0.8, or FIFU Premium before 8.2.8) and a logged-in administrator who can be induced to visit an attacker-controlled page while their WordPress session is active (UI:R). The attacker needs no account on the target (PR:N). The core technical precondition is the plugin's own flaw: supplying the specific crafted URL form that causes the REST API nonce check to be skipped for the whole request - this is the enabling condition, not an operator misconfiguration. Limiting factors: the admin must be authenticated and must interact (click/visit), so the attack is social-engineering-dependent rather than fully automated, and it is neutralized by applying the vendor patch.

This is a genuinely high-priority flaw for any site running the affected plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) is consistent with the description: a nonce-enforcement defect lets a crafted URL disable the REST API nonce check for an entire request, converting authenticated REST endpoints into CSRF-exploitable actions. The attacker themselves needs no credentials (PR:N), but the attack is gated on social engineering a logged-in administrator into visiting an attacker-controlled page (UI:R), which is why this is not a fully automatable mass-exploitation primitive. The full C:H/I:H/A:H impact is justified because the proof scenario - forcing creation of a new administrator account - yields complete site takeover. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation; the signal here is a credible vendor-grade report (WPScan) plus an available patch, not observed in-the-wild abuse. Net: treat as a real, patch-now issue because of the takeover impact and low complexity, while recognizing the UI:R requirement makes it opportunistic/targeted rather than wormable. No conflicting signals were found between the CVSS vector and the description.

An attacker crafts a malicious web page containing an auto-submitting request to the WordPress REST API with the special URL form that disables the plugin's nonce validation, then lures a logged-in administrator to visit it (e.g., via a phishing link). The forged request executes under the admin's session and creates a new attacker-controlled administrator account, granting full site control. No public exploit code is identified at time of analysis, though the mechanism is clearly described by the reporting vendor.