CVE-2026-101147

Name of the Vulnerable Software and Affected Versions Featured Image from URL (FIFU) WordPress plugin versions prior to 6.0.8 Featured Image from URL (FIFU) Premium WordPress plugin versions prior to 8.2.8

Description Cross-Site Request Forgery (CSRF) occurs because the software fails to correctly enforce the REST API nonce. When a crafted URL is used, the check is disabled for the entire request, allowing an attacker to force a logged-in administrator to execute any REST API action, including the creation of a new administrator account.

Recommendations Update Featured Image from URL (FIFU) WordPress plugin to version 6.0.8 or later. Update Featured Image from URL (FIFU) Premium WordPress plugin to version 8.2.8 or later.