CVE-2025-10036 describes an SQL Injection vulnerability in the Featured Image from URL (FIFU) WordPress plugin, affecting all versions up to 5.2.7. The issue exists in the get_all_urls() function due to improper neutralization of special elements in SQL commands, specifically insufficient escaping and lack of prepared statements for user input. This allows authenticated administrators to inject additional SQL queries, which can be used to extract sensitive data from the database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 4.9 (medium severity). No patch or remediation details are currently available from the vendor or advisory sources.

An authenticated attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks, enabling them to extract sensitive information from the WordPress database. The vulnerability does not directly impact availability or integrity but compromises confidentiality of data stored in the database. There are no known exploits in the wild, and the attack requires high privileges, limiting the scope of potential attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity. Avoid using vulnerable versions of the plugin if possible. Do not rely on generic mitigations as the vulnerability specifically requires proper input escaping and query preparation.