CVE-2025-13439: 
WordPress vulnerability analysis and mitigation

CVE-2025-13439 is an information disclosure and PHAR deserialization vulnerability in the Fancy Product Designer plugin for WordPress, developed by Radykal. It affects all versions up to and including 6.4.8, allowing unauthenticated attackers to read arbitrary sensitive files from the server — including wp-config.php — by exploiting an unsanitized url parameter in the fpd_custom_uplod_file AJAX action. The vulnerability was published on December 16, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 5.9 (Medium) (Wordfence, Red Hat).

The root cause is insufficient input validation (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the fpd_custom_uplod_file AJAX action, where the user-supplied url parameter flows directly into PHP's getimagesize() function without sanitization. This allows attackers to supply arbitrary file paths or PHP filter chain URIs to read server-side files. On PHP 8+, direct exploitation via PHP filter chains is blocked due to a separate code bug in the plugin, but the vulnerability remains exploitable through a TOCTOU (Time-of-Check to Time-of-Use) race condition described in CVE-2025-13231, also present in the same plugin. On PHP 7.x installations, direct exploitation may be possible without the race condition (Wordfence, ENISA EUVD).

Successful exploitation allows unauthenticated remote attackers to read arbitrary files from the web server, with the most critical target being wp-config.php, which contains database credentials, authentication keys, and salts. Exposure of these credentials could enable full WordPress database compromise, administrative account takeover, and lateral movement within the hosting environment. The vulnerability has no integrity or availability impact, but the confidentiality impact is rated High due to the sensitivity of the files that can be accessed (Wordfence, Red Hat).

No public exploit code or active in-the-wild exploitation has been confirmed as of the available data. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation complexity is rated High, as PHP 8+ environments require chaining with the race condition in CVE-2025-13231, while PHP 7.x environments may be directly exploitable (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Fancy Product Designer plugin (versions ≤ 6.4.8) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at /wp-content/plugins/fancy-product-designer/readme.txt.
2. Determine PHP version: Probe the target to determine whether it runs PHP 7.x (direct exploitation possible) or PHP 8+ (race condition required via CVE-2025-13231).
3. Craft malicious AJAX request: Send an unauthenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with action=fpd_custom_uplod_file and set the url parameter to a target file path, e.g., using a PHP filter chain URI such as php://filter/convert.base64-encode/resource=/var/www/html/wp-config.php (on PHP 7.x).
4. Exploit race condition (PHP 8+): If targeting a PHP 8+ server, chain with the TOCTOU race condition described in CVE-2025-13231 to bypass the code bug that otherwise blocks filter chain exploitation.
5. Extract sensitive data: Parse the server response to retrieve the base64-encoded or raw contents of wp-config.php, extracting database credentials (DB_NAME, DB_USER, DB_PASSWORD, DB_HOST) and WordPress secret keys.
6. Escalate access: Use the extracted database credentials to connect to the WordPress database directly (if exposed) or use the authentication keys to forge session cookies and gain administrative access (Wordfence, ENISA EUVD).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=fpd_custom_uplod_file and a url parameter containing php://filter, file://, or absolute file paths (e.g., /var/www/html/wp-config.php).
• Logs: Web server access logs showing repeated AJAX requests to admin-ajax.php from the same IP with varying url parameter values; HTTP 200 responses to these requests from unauthenticated sessions.
• File System: No direct file system artifacts expected from read-only exploitation, but subsequent compromise may result in new PHP webshells or modified plugin files if credentials are leveraged.
• Application Logs: WordPress debug logs (wp-content/debug.log) may show errors related to getimagesize() being called with non-image URIs or file paths.

As of the disclosure date (December 16, 2025), no patch was confirmed available for the Fancy Product Designer plugin (all versions through 6.4.8 are affected). Site administrators should consider deactivating and removing the plugin until a patched version is released by the vendor (Radykal). As a compensating control, restrict access to wp-admin/admin-ajax.php for unauthenticated users where possible via WAF rules, and ensure wp-config.php is protected at the server level (e.g., via .htaccess or Nginx configuration denying direct access). Monitor the vendor's support forum for patch availability (Wordfence, Vendor Forum).

The vulnerability was discovered and reported by Wordfence, which published the advisory on December 16, 2025. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure and standard vulnerability database aggregation has been identified (Wordfence).