CVE-2025-15526

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15526", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-15T16:36:27.098Z", "datePublished": "2026-01-16T04:44:34.337Z", "dateUpdated": "2026-04-08T17:11:13.686Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:13.686Z"}, "affected": [{"vendor": "radykal", "product": "Fancy Product Designer", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.4.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper error handling in the PDF upload functionality that exposes server filesystem paths and stack traces in error messages. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website."}], "title": "Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b39b4ce-3885-4ea4-8cf0-84e66e7f6a12?source=cve"}, {"url": "https://support.fancyproductdesigner.com/support/discussions/topics/13000036024"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-209 Generation of Error Message Containing Sensitive Information", "cweId": "CWE-209", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Zeeshan"}], "timeline": [{"time": "2025-11-19T16:29:24.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-15T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T14:02:25.993009Z", "id": "CVE-2025-15526", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:02:37.573Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15526", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T14:02:25.993009Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:02:33.579Z"}}], "cna": {"title": "Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Zeeshan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "radykal", "product": "Fancy Product Designer", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.4.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-19T16:29:24.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-15T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b39b4ce-3885-4ea4-8cf0-84e66e7f6a12?source=cve"}, {"url": "https://support.fancyproductdesigner.com/support/discussions/topics/13000036024"}], "descriptions": [{"lang": "en", "value": "The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper error handling in the PDF upload functionality that exposes server filesystem paths and stack traces in error messages. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "CWE-209 Generation of Error Message Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:13.686Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15526", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:11:13.686Z", "dateReserved": "2026-01-15T16:36:27.098Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-16T04:44:34.337Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Fancy Product Designer", "vendor": "radykal", "versions": [{"lessThanOrEqual": "6.4.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper error handling in the PDF upload functionality that exposes server filesystem paths and stack traces in error messages. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website."}, {"lang": "es", "value": "El plugin Fancy Product Designer para WordPress es vulnerable a la Divulgaci\u00f3n de Ruta Completa en todas las versiones hasta, e incluyendo, la 6.4.8. Esto se debe a un manejo inadecuado de errores en la funcionalidad de carga de PDF que expone rutas del sistema de archivos del servidor y rastros de pila en los mensajes de error. Esto hace posible que atacantes no autenticados recuperen la ruta completa de la aplicaci\u00f3n web, lo cual puede ser usado para ayudar a otros ataques. La informaci\u00f3n mostrada no es \u00fatil por s\u00ed misma, y requiere que otra vulnerabilidad est\u00e9 presente para causar da\u00f1o a un sitio web afectado."}], "id": "CVE-2025-15526", "lastModified": "2026-06-17T08:37:57.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15526", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T14:02:25.993009Z", "version": "2.0.3"}}]}, "published": "2026-01-16T05:16:13.130", "references": [{"source": "security@wordfence.com", "url": "https://support.fancyproductdesigner.com/support/discussions/topics/13000036024"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b39b4ce-3885-4ea4-8cf0-84e66e7f6a12?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:22:41.806324+00:00", "value": {"mitigation_remediation": ["Upgrade the Fancy Product Designer plugin to the latest available version, which fixes the error-handling issue.", "If an immediate upgrade is not possible, restrict access to the PDF upload endpoint or disable the feature entirely to prevent error disclosure.", "Keep WordPress and WooCommerce core, plugins, and the theme up to date to avoid other undisclosed vulnerabilities that could leverage the disclosed path information."], "summary": {"action": "Patch Now", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Fancy Product Designer plugin by Radykal, all versions up to and including 6.4.8.", "description_and_impact": "The Fancy Product Designer plugin for WordPress contains improper error handling in its PDF upload feature, exposing full server filesystem paths and stack traces in error messages. This allows unauthenticated attackers to learn the underlying directory structure of the web application, which can aid in launching additional attacks but is not useful on its own to compromise the site.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 5.3 and an EPSS of less than 1%, indicating a moderate severity but a very low probability that it is being actively exploited today. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated request to the PDF upload endpoint with a crafted 'pdf' parameter, which causes the plugin to return filesystem paths in the error response. While the information disclosed does not directly lead to a compromise, it provides an attacker with valuable context that can be used to target other, more severe weaknesses."}}}}, "created": "2026-01-16T13:41:51.548718+00:00", "updated": "2026-04-21T16:30:40.678090+00:00", "vendors": ["radykal", "radykal$PRODUCT$fancy_product_designer", "wordpress", "wordpress$PRODUCT$wordpress"]}