目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2026-101147— Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

一分钟漏洞结论

影响对象
Unknown Featured Image from URL (FIFU)
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

WordPress 插件“Featured Image from URL (FIFU)”在 6.0.8 版本之前，以及“Featured Image from URL (FIFU) Premium”在 8.2.8 版本之前，未能正确执行 REST API 的 nonce（一次性令牌）验证。当使用特制的 URL 时，该检查会被整个请求禁用，这可能允许攻击者通过跨站请求伪造（CSRF）攻击，诱导已登录的管理员执行任意 REST API 操作，例如创建新的管理员账户。

获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-101147 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF
来源: CVE Program / CVE List V5
Vulnerability Description
The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5

受影响产品

厂商 产品 影响版本 CPE 订阅
Unknown Featured Image from URL (FIFU) 6.0.0 ~ 6.0.8 -
Unknown Featured Image from URL (FIFU) Premium 6.8.0 ~ 8.2.8 -

二、漏洞 CVE-2026-101147 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-101147 的情报信息

请登录查看更多情报信息。

CVE-2026-101147 其他参考 (1)

同批安全公告 · Unknown · 2026-10-01 · 共 15 条

CVE-2026-96173 Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR
CVE-2026-96200 Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Pay
CVE-2026-96255 Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via D
CVE-2026-89296 Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter
CVE-2026-87973 If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name
CVE-2026-87970 If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes
CVE-2026-92412 Five Star Restaurant Reviews < 2.3.14 - Reflected XSS
CVE-2026-90972 WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deleti
CVE-2026-90974 WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update
CVE-2026-19253 Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_e
CVE-2026-81739 Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
CVE-2026-81809 Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback
CVE-2026-86610 Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon
CVE-2026-101148 BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via E

IV. Related Vulnerabilities

Same product: Featured Image from URL (FIFU)
Same vendor: Unknown

V. Comments for CVE-2026-101147

暂无评论

发表评论