CVE-2025-13439: medium-severity vulnerability in radykal Fancy Product Designer
Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.3%
The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
radykal · Fancy Product DesignerRelated CVEs — radykal Fancy Product Designer
In the same product, most dangerous first.
CVE-2024-51818CRITICALWordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerabilityEPSS 16.2%CVE-2021-4334HIGHFancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_optionsEPSS 0.7%CVE-2024-51919CRITICALWordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2021-4335MEDIUMFancy Product Designer <= 4.6.9 - Insufficient Authorization on Mulitple AJAX ActionsEPSS 0.4%CVE-2025-15526MEDIUMFancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' ParameterEPSS 0.3%CVE-2026-84280HIGHFancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' ParameterEPSS 0.3%