---
id: CVE-2025-13439
title: >-
  The Fancy Product Designer plugin for WordPress is vulnerable to Information
  Disclosure and PHAR Deserialization in all versions up to, and including,
  6.4.8
summary: >-
  The Fancy Product Designer plugin for WordPress is vulnerable to Information
  Disclosure and PHAR Deserialization in all versions up to, and including,
  6.4.8. This is due to insufficient validation of user-supplied input in the
  'url' para…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
published: '2025-12-16'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T19:10:00.160'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13439'
references:
  - url: >-
      https://support.fancyproductdesigner.com/support/discussions/topics/13000036024
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd6df9d-2963-44b1-bc4e-e53eda97a2a9?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00309
epssPercentile: 0.21625
ingestedAt: '2026-10-07T20:46:46.950Z'
---

## Overview

The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.