{"id":"CVE-2026-96671","published":"2026-10-09T10:16:45.697","lastModified":"2026-10-09T21:17:08.080","description":"Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/featured-image-from-url/vulnerability/wordpress-featured-image-from-url-plugin-6-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A cross-site request forgery vulnerability in the Featured Image from URL plugin allows attackers to perform unauthorized actions on behalf of authenticated users. This is particularly dangerous because it can lead to complete compromise of user accounts and site functionality.","exploitability":"Exploitation requires a user to click a malicious link or visit a compromised website, making it moderately difficult to achieve but still quite possible with social engineering.","blast_radius":"If exploited, this vulnerability could allow attackers to modify featured images across the entire site, potentially leading to widespread content manipulation and trust issues for users.","remediation":"Upgrade to version 6.0.8 or later to remediate this CSRF vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["csrf","web","wordpress","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:50:37.117Z"}}