Featured Image from URL (FIFU): CSRF enables administrator account creation
Summary
The Featured Image from URL (FIFU) WordPress plugin, free and Premium editions, does not correctly enforce the REST API nonce for crafted URLs. An attacker can use Cross-Site Request Forgery to make a logged-in administrator perform REST API actions, such as creating a new administrator account. The attacker needs no account, but an administrator must be logged in and visit a malicious page or link. Successful exploitation can lead to full takeover of the WordPress site.
Affected
- FIFU (free): 6.0.0 to before 6.0.8
- FIFU Premium: 6.8.0 to before 8.2.8
- Older versions: Unknown.
Fixed in
- FIFU (free): 6.0.8 or later
- FIFU Premium: 8.2.8 or later
Workaround
- Unknown. No vendor workaround has been confirmed.
- If patching is delayed, restrict administrator logins and avoid browsing untrusted sites while logged in.
- A WAF rule blocking REST API calls without a valid nonce may help, but it is unverified and may cause false positives.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- Not listed in CISA KEV. EPSS below 1%.
- Exploitation in the wild: none found.
- Public proof of concept: Unknown.
Our recommendation
- Identify all WordPress sites with FIFU or FIFU Premium and record their versions.
- Update to FIFU 6.0.8 or later and FIFU Premium 8.2.8 or later.
- Review the administrator user list for unexpected accounts.
- Remind administrators not to browse untrusted sites while logged into WordPress.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan: Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF wpscan.com
- VulDB: CVE-2026-101147 vuldb.com
- OpenCVE: CVE-2026-101147 app.opencve.io
- Threatint: CVE-2026-101147 cve.threatint.com
- Wordfence: FIFU earlier CSRF vulnerability (nonce validation) www.wordfence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:02.
Original description (NVD)
The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.