CVE-2025-15526 is a vulnerability in the Fancy Product Designer WordPress plugin that leads to Full Path Disclosure through error messages generated during PDF upload failures. The plugin improperly handles errors, exposing sensitive server path information and stack traces to unauthenticated users. This information disclosure is classified under CWE-209 (Generation of Error Message Containing Sensitive Information). Although the information disclosed does not directly compromise confidentiality or integrity, it can facilitate further attacks if other vulnerabilities exist. The vulnerability affects all versions up to and including 6.4.8. There is no vendor-provided patch or advisory at this time, and no known exploits have been observed.

The vulnerability allows unauthenticated attackers to obtain full server filesystem paths and stack traces via error messages. This information disclosure is limited in impact by itself, as it does not grant direct access or control. However, it can aid attackers in reconnaissance and in exploiting other vulnerabilities on the affected system. There is no indication of data loss, privilege escalation, or denial of service solely from this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or restricting the PDF upload functionality or error message verbosity to prevent sensitive information leakage. Monitoring for updates from the vendor or security advisories is recommended.