Security Alert Summary
The Fancy Product Designer plugin for WordPress contains an information disclosure vulnerability that can allow unauthenticated attackers to read sensitive files on the server. The issue is tied to insufficient validation of a user-supplied url parameter in an AJAX action, and may be exploitable on PHP 7.x or via a race condition in certain configurations.
CVE Details
- CVE ID:
CVE-2025-13439 - Affected component: Fancy Product Designer plugin for WordPress
- Affected versions: All versions up to, and including, 6.4.8
- Published: December 16, 2025 at 08:15:51 AM UTC
- Last modified: December 16, 2025 at 02:10:11 PM UTC
- CVSS v3.1: Base score 5.9 (MEDIUM) —
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Authentication / privileges / user interaction: No authentication required (PR:N). Privileges required: none. User interaction: none. Attack complexity: high.
- Primary impact: Confidentiality: High; Integrity: None; Availability: None.
- Weakness (CWE): CWE-200 (Information Exposure)
Technical Details
The vulnerability stems from insufficient validation of user-supplied input in the url parameter of the fpd_custom_uplod_file AJAX action. The value of this parameter is passed directly into PHP’s getimagesize() function without proper sanitization. Because getimagesize() can trigger file access, an attacker can use this path to read files on the server.
The CVE description notes that on PHP 8+ a separate plugin code bug blocks direct exploitation via PHP filter chains, but the issue can still be exploited via a TOCTOU race condition (referenced as CVE-2025-13231) present in the same plugin. On PHP 7.x installations the flaw may be directly exploitable without relying on the race condition. The disclosed impact explicitly includes the ability for unauthenticated attackers to read arbitrary sensitive files such as wp-config.php.
How This Could Impact Your Website
In a typical small-to-medium WordPress site, the site owner may install Fancy Product Designer and give internal staff or external contractors contributor or editor access to manage product assets. An unauthenticated attacker exploiting this vulnerability could access server files that contain configuration details or credentials. Practical consequences include exposure of database credentials or other secrets stored in configuration files, which can enable further targeted attacks.
Exposure of internal user email addresses or configuration details can increase the risk of targeted phishing or social engineering attacks against staff and contributors. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other accounts with upload or content management capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and server logs for unusual behavior, such as unexpected requests to AJAX actions or attempts to access configuration files.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
