CVE-2025-9985 is a vulnerability in the marceljm Featured Image from URL (FIFU) WordPress plugin, affecting all versions up to and including 5.2.7. The issue involves sensitive information being written to log files that are publicly accessible, enabling unauthenticated attackers to retrieve this information. The vulnerability is categorized under CWE-532 (Insertion of Sensitive Information into Log File). The CVSS v3.1 base score is 5.3, reflecting a network attack vector with low complexity and no required privileges or user interaction. No patch or official fix has been documented in the provided data.

An unauthenticated attacker can access sensitive information exposed in publicly accessible log files generated by the FIFU plugin. This may lead to information disclosure but does not impact integrity or availability. The medium severity score reflects the confidentiality impact without further exploitation details or known active attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to log files to prevent unauthorized viewing. Monitor official channels for updates from the plugin vendor regarding patches or mitigation recommendations.