CVE-2026-96671: WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Q: Who is exposed to this issue?

Sites using the Featured Image from URL plugin are affected through version 6.0.7. The available information does not identify a lower affected version boundary.

Q: What does exploitation require?

Exploitation is network-accessible, requires no attacker privileges, and requires user interaction. The provided data classifies the issue as CSRF and indicates potential high impact to confidentiality, integrity, and availability.

Published Oct 9, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7.

Affected Software

1 affected component

fifu.app Featured Image from URL<=6.0.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Featured Image from URL to a version that resolves this vulnerability.
Fixed in 6.0.8

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using the Featured Image from URL plugin are affected through version 6.0.7. The available information does not identify a lower affected version boundary.

What does exploitation require?

Exploitation is network-accessible, requires no attacker privileges, and requires user interaction. The provided data classifies the issue as CSRF and indicates potential high impact to confidentiality, integrity, and availability.

CVE-2026-96671: WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does exploitation require?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does exploitation require?