CVE-2025-13439

MEDIUM 5.9 CVSS 3.1

Published: December 16, 2025
Last modified: October 7, 2026
NVD status: Deferred
Reported by: security@wordfence.com
Weakness: CWE-200
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.

Affected products and versions

radykal Fancy Product Designer — Up to and including 6.4.8

References

support.fancyproductdesigner.com https://support.fancyproductdesigner.com/support/discussions/topics/13000036024
www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd6df9d-2963-44b1-bc4e-e53eda97a2a9?source=cve
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References