CVE-2025-13393 is a Server-Side Request Forgery vulnerability in the Featured Image from URL (FIFU) WordPress plugin, affecting all versions up to 5.3.1. The issue arises from insufficient validation of user-supplied URLs before they are passed to the getimagesize() function within the Elementor widget integration. This allows authenticated users with Contributor-level permissions or higher, who have access to Elementor, to cause the server to make arbitrary HTTP requests to internal or external resources using the fifu_input_url parameter. The vulnerability does not require user interaction beyond authentication and has a CVSS 3.1 base score of 4.3 (medium severity). There is no indication of an official patch or vendor advisory at this time, and no known active exploitation has been reported.

An attacker with Contributor-level or higher access and Elementor usage permissions can leverage this SSRF vulnerability to make the server perform arbitrary HTTP requests. This could allow the attacker to access internal network resources or services that are not otherwise accessible externally. The impact is limited to information disclosure (confidentiality) as per the CVSS vector, with no integrity or availability impact indicated. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level users from accessing Elementor or the FIFU Elementor widget to prevent exploitation. Monitor for updates from the plugin vendor or WordPress security channels for official patches or mitigations.