CVE-2025-10037 is an SQL Injection vulnerability in the Featured Image from URL (FIFU) WordPress plugin, affecting all versions up to 5.2.7. The issue is located in the get_posts_with_internal_featured_image() function, where user input is not properly escaped or prepared before being included in SQL queries. This allows authenticated users with Administrator-level access or higher to inject additional SQL commands into existing queries, enabling unauthorized extraction of sensitive data from the database. The vulnerability has a CVSS 3.1 base score of 4.9 (medium severity) with network attack vector, low attack complexity, and high confidentiality impact but no integrity or availability impact. No known exploits in the wild or patches are currently documented.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the WordPress database. The impact is limited to confidentiality as there is no indication of integrity or availability compromise. Since the attacker must already have high privileges, the risk is somewhat mitigated by the prerequisite access level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid using the affected versions of the plugin if possible.