The Fancy Product Designer plugin for WordPress suffers from an information disclosure vulnerability (CWE-200) caused by insufficient validation of user input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action. This input is used directly in the getimagesize function without sanitization, allowing unauthenticated attackers to read arbitrary files on the server, including sensitive configuration files such as wp-config.php. The vulnerability affects all versions up to and including 6.4.8. The CVSS v3.1 base score is 5.9, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact.

Successful exploitation allows unauthenticated attackers to read sensitive files on the server, potentially exposing critical configuration data such as database credentials contained in wp-config.php. This can lead to further compromise of the WordPress installation or underlying infrastructure. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable AJAX action if possible or implement web application firewall (WAF) rules to block malicious requests targeting the 'url' parameter. Monitor for updates from the vendor (radykal) regarding patches or official mitigations.