CVE-2026-96671: Cross-Site Request Forgery (CSRF) in fifu.app Featured Image from URL

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Featured Image from URL plugin by fifu.app, affecting all versions prior to 6.0.8. An attacker could exploit this flaw to trick an authenticated user into executing unwanted actions without their consent. The vulnerability has a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow attackers to perform unauthorized actions with the privileges of an authenticated user, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system or data managed by the plugin.

No explicit patch or remediation link is provided in the available data. The affected versions are all versions prior to 6.0.8. Users should upgrade to version 6.0.8 or later once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.