WordPress Featured Image from URL Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure has been identified in the Featured Image from URL (FIFU) plugin for WordPress, affecting all versions through 5.2.7. The issue arises from publicly accessible log files that can be viewed by unauthenticated attackers, potentially revealing sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information contained in the exposed log files.

Reproduction

The vulnerability can be reproduced by accessing the public log files created by the FIFU plugin. This can be done through the WordPress REST API or by directly navigating to the log file's URL, which is located in the uploads directory.

Remediation

Users are advised to update the Featured Image from URL plugin to version 5.2.8 or later.