CVE-2026-96671
8.8 HIGHPublished 2026-10-09 · Updated 2026-10-09
AI risk analysis
- Summary
- A cross-site request forgery vulnerability in the Featured Image from URL plugin allows attackers to perform unauthorized actions on behalf of authenticated users. This is particularly dangerous because it can lead to complete compromise of user accounts and site functionality.
- Exploitability
- Exploitation requires a user to click a malicious link or visit a compromised website, making it moderately difficult to achieve but still quite possible with social engineering.
- Blast radius
- If exploited, this vulnerability could allow attackers to modify featured images across the entire site, potentially leading to widespread content manipulation and trust issues for users.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 6.0.8 or later to remediate this CSRF vulnerability.
csrfwebwordpressplugin
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-14378
- HIGHCVE-2026-19125
- HIGHCVE-2026-48199
- CRITICALCVE-2026-85984
- HIGHCVE-2026-88826
- HIGHCVE-2026-89193
- HIGHCVE-2026-96451
- CRITICALCVE-2025-15399
Related by shared AI tags and CWE weakness class. Browse the full archive.