Featured Image from URL: Cross-Site Request Forgery (CSRF)

Summary

The WordPress plugin Featured Image from URL (FIFU) is affected by a Cross-Site Request Forgery flaw in all versions up to and including 6.0.7. An attacker can craft a malicious page that makes a logged-in user unknowingly perform actions on the WordPress site, such as changing settings. Exploitation requires that a privileged user visits the attacker's page while logged in.

Affected

• WordPress plugin Featured Image from URL (FIFU) by fifu.app
• All versions from n/a through 6.0.7

Fixed in

• Patched version according to Patchstack and the CVE record: 6.0.8 or later
• Newer releases exist, but the changelog does not confirm which release closes this CVE. Verify on the plugin page before relying on a specific version.

Workaround

• No vendor-published workaround found.
• Patchstack reports a mitigation rule for this plugin. Ask your hosting provider or Patchstack whether it covers this CVE.
• Limit administrator and editor accounts and have privileged users avoid browsing other sites while logged in to the WordPress admin area.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable.
• VulDB reports no exploit is available. No public proof of concept or exploitation in the wild was found.

Our recommendation

• Update the plugin to version 6.0.8 or later, or to the latest release confirmed to fix this CVE.
• Until then, restrict administrator and editor accounts and keep WordPress and all plugins up to date.
• Check whether the WordPress admin area is reachable from the internet and restrict access if possible.
• Monitor for unexpected changes to plugin settings or content.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack: WordPress Featured Image from URL plugin <= 6.0.7 - CSRF patchstack.com
• Rapid7 Vulners: CVE-2026-96671 vulners.com
• VulDB: CVE-2026-96671 entry vuldb.com
• WordPress.org: Featured Image from URL plugin wordpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:56.