FIFU - Information Disclosure (CVE-2025-9985)

CVE-2025-9985 is a vulnerability in the Featured Image from URL (FIFU) WordPress plugin that exposes sensitive information through publicly accessible log files. This flaw allows unauthenticated attackers to access potentially confidential data, increasing the risk of information disclosure and privacy breaches on affected WordPress sites.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-9985 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-9985 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers attempt to access publicly exposed log files at /wp-content/uploads/fifu-plugin.log and /wp-content/uploads/fifu-cloud.log to retrieve sensitive information from vulnerable WordPress sites using the Featured Image from URL plugin.