CVE-2025-13439

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13439", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-19T19:03:47.252Z", "datePublished": "2025-12-16T07:21:05.706Z", "dateUpdated": "2026-04-08T16:52:08.967Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:08.967Z"}, "affected": [{"vendor": "radykal", "product": "Fancy Product Designer", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.4.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php."}], "title": "Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd6df9d-2963-44b1-bc4e-e53eda97a2a9?source=cve"}, {"url": "https://support.fancyproductdesigner.com/support/discussions/topics/13000036024"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Zeeshan"}], "timeline": [{"time": "2025-11-19T19:20:26.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-15T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-16T21:33:39.485822Z", "id": "CVE-2025-13439", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T21:33:47.996Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13439", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-16T21:33:39.485822Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T21:33:43.804Z"}}], "cna": {"title": "Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Zeeshan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "radykal", "product": "Fancy Product Designer", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "6.4.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-19T19:20:26.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-15T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd6df9d-2963-44b1-bc4e-e53eda97a2a9?source=cve"}, {"url": "https://support.fancyproductdesigner.com/support/discussions/topics/13000036024"}], "descriptions": [{"lang": "en", "value": "The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-22T01:31:25.048Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13439", "state": "PUBLISHED", "dateUpdated": "2026-01-22T01:31:25.048Z", "dateReserved": "2025-11-19T19:03:47.252Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-16T07:21:05.706Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Fancy Product Designer", "vendor": "radykal", "versions": [{"lessThanOrEqual": "6.4.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php."}, {"lang": "es", "value": "El plugin Fancy Product Designer para WordPress es vulnerable a revelaci\u00f3n de informaci\u00f3n y deserializaci\u00f3n PHAR en todas las versiones hasta la 6.4.8, inclusive. Esto se debe a una validaci\u00f3n insuficiente de la entrada proporcionada por el usuario en el par\u00e1metro 'url' de la acci\u00f3n AJAX 'fpd_custom_uplod_file', que fluye directamente a la funci\u00f3n 'getimagesize' sin sanitizaci\u00f3n. Esto hace posible que atacantes no autenticados lean archivos sensibles arbitrarios del servidor, incluyendo wp-config.php."}], "id": "CVE-2025-13439", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13439", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-16T21:33:39.485822Z", "version": "2.0.3"}}]}, "published": "2025-12-16T08:15:51.753", "references": [{"source": "security@wordfence.com", "url": "https://support.fancyproductdesigner.com/support/discussions/topics/13000036024"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd6df9d-2963-44b1-bc4e-e53eda97a2a9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:04:57.414901+00:00", "value": {"mitigation_remediation": ["Upgrade the Fancy Product Designer plugin to a version newer than 6.4.8 that removes the vulnerable AJAX entry point.", "Restrict access to the 'fpd_custom_uplod_file' AJAX endpoint so that only authenticated administrators can invoke it, or disable the endpoint if it is not needed.", "Verify that server file permissions isolate sensitive files such as wp-config.php from web access, and configure the web server to disallow PHAR deserialization through shared modules or security policies."], "summary": {"action": "Patch Now", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "All releases of the Fancy Product Designer plugin from the vendor radykal up to and including version 6.4.8 are affected. The vulnerability is present in WordPress installations that employ this plugin, allowing unauthenticated web users to trigger the vulnerable AJAX action and read server files. Any site running WordPress with 6.4.8 or earlier is therefore at risk, regardless of whether WooCommerce is also installed.", "description_and_impact": "The Fancy Product Designer plugin for WordPress is vulnerable to an unauthenticated information disclosure flaw that also allows PHAR deserialization. The issue originates from the 'url' parameter in the 'fpd_custom_uplod_file' AJAX action, which is passed directly into PHP\u2019s getimagesize function without proper sanitization. Because the function reads image metadata, an attacker can cause the server to load arbitrary files, including the sensitive wp-config.php, resulting in exposure of database credentials and other secret data. This flaw does not grant code execution but offers attackers a path to read any file that the web server process can access.", "risk_and_exploitability": "The flaw carries a CVSS score of 5.9, indicating a moderate risk severity. The EPSS score is listed as less than 1, implying that the likelihood of exploitation observed in the wild is low, and the issue is not currently catalogued in the CISA KEV list. Attackers can exploit the weakness by sending an unauthenticated HTTP request to the plugin\u2019s AJAX endpoint with a crafted 'url' value, immediately retrieving the contents of arbitrary files without authentication. Because the vulnerability is reported as Data Exposure, the impact remains limited to confidentiality rather than integrity or availability."}}}}, "created": "2025-12-16T17:08:53.942311+00:00", "updated": "2026-04-21T17:15:25.329443+00:00", "vendors": ["radykal", "radykal$PRODUCT$fancy_product_designer", "wordpress", "wordpress$PRODUCT$wordpress"]}