What is GHSA-82w4-rrj7-r5qj?

GHSA-82w4-rrj7-r5qj is a security advisory published by GitHub Security Advisories with High severity. The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU)...

Which CVE IDs does GHSA-82w4-rrj7-r5qj cover?

GHSA-82w4-rrj7-r5qj covers the following CVE IDs: CVE-2026-101147. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-82w4-rrj7-r5qj?

GHSA-82w4-rrj7-r5qj has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-82w4-rrj7-r5qjHighCVSS 8.8

The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU)...

Vendor

GitHub Security Advisories

Published

October 1, 2026

Last Modified

October 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-101147 →

📋 Description

The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-101147
https://wpscan.com/vulnerability/45ac761c-5736-4bd3-a3c1-892e703f5da6
https://github.com/advisories/GHSA-82w4-rrj7-r5qj