CVE-2025-9984 is a missing authorization vulnerability (CWE-862) in the Featured Image from URL (FIFU) WordPress plugin by marceljm. The issue arises because the fifu_api_debug_posts() function does not perform capability checks, enabling unauthenticated users to read private or password-protected posts. This affects all versions up to and including 5.2.7. The vulnerability has a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact.

An attacker without authentication can read private or password-protected posts on a WordPress site using the vulnerable FIFU plugin. This leads to unauthorized disclosure of potentially sensitive content. There is no impact on integrity or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the FIFU plugin if private content confidentiality is critical. Monitor vendor channels for updates and apply any released patches promptly.