Security Alert Summary
The Featured Image from URL (FIFU) plugin for WordPress contains a server-side request forgery (SSRF) vulnerability in its Elementor widget integration. Authenticated users with Contributor-level access or higher can supply a URL via the fifu_input_url parameter that is passed to getimagesize() without sufficient validation, allowing requests to arbitrary locations originating from the web application.
CVE Details
- CVE ID:
CVE-2025-13393 - Affected component: Featured Image from URL (FIFU) plugin for WordPress (Elementor widget integration)
- Affected versions: All versions up to, and including, 5.3.1
- Published: January 10, 2026 at 2:15:49 PM UTC
- Last modified: January 10, 2026 at 2:15:49 PM UTC
- CVSS v3.1: Base score 4.3, Severity MEDIUM, Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Authentication / privileges / user interaction: Requires an authenticated user with low privileges (reported as Contributor-level access and above). No user interaction is required.
- Primary impact: Confidentiality: Low; Integrity: None; Availability: None
- CWE / weakness: CWE-918 (Server-Side Request Forgery)
Technical Details
The vulnerability exists because user-supplied URLs provided to the FIFU Elementor widget are not sufficiently validated before being passed to the getimagesize() function. An authenticated user with the ability to use the Elementor widget can set the fifu_input_url parameter to an arbitrary URL. Because the plugin issues a request from the web application to that URL without proper validation or filtering, this enables server-side request forgery (SSRF).
Successful exploitation allows the attacker to make the web application perform HTTP requests to internal or external resources reachable from the server. The CVE description notes that these requests can be used to query and modify information from internal services when the attacker has permission to use Elementor.
How This Could Impact Your Website
Consider a site where the owner maintains administrative control, editors and contributors create and manage content, and an external contractor contributes posts or media. If a contributor (or any user with the ability to use Elementor widgets) submits a crafted URL via the FIFU Elementor widget, the server could be used to request internal endpoints or services not normally accessible externally. This may lead to limited exposure of internal service data or resources reachable from the web server, consistent with the CVSS confidentiality impact being rated as low.
Practical consequences include potential disclosure of information from internal services and an increased risk of targeted phishing or social engineering when attacker-controlled requests reveal email addresses or other internal data. The vulnerability does not indicate direct integrity or availability impact to the site itself according to the CVSS metrics.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that can access page-builder or widget functionality.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and limit the number of users who can use Elementor widgets.
- Monitor site activity and logs for unusual behavior or unexpected outbound requests originating from the web server.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/elementor/widgets/widget.php#L121
- https://plugins.trac.wordpress.org/browser/featured-image-from-url/trunk/elementor/widgets/widget.php#L94
- https://plugins.trac.wordpress.org/changeset/3428744/
- https://research.cleantalk.org/cve-2025-13393/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b7115070-b84d-4d69-993a-f512b9f9c081?source=cve
