CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
What the vulnerability does
The Image Resizer On The Fly plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' task in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
Image Resizer On The Fly versions 1.1 and earlier contain a path traversal vulnerability that allows an attacker to write files outside the intended directory. An unauthenticated attacker can exploit this over the network without user interaction to modify or create files on the server, potentially compromising site integrity and availability.
What an attacker can do
Write or overwrite files anywhere on the server filesystem without authentication.
Potential impact on your site
Attackers can modify site files, inject malicious code, or delete critical data, leading to site defacement or complete compromise.
Conditions required to exploit
Network access to the vulnerable application; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
