What is the CVSS score of CVE-2026-1557?

CVE-2026-1557 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-1557?

The WP Responsive Images plugin contains a critical vulnerability allowing unauthenticated attackers to read arbitrary files from affected WordPress servers, potentially exposing sensitive data such…

Is there a public PoC exploit available for CVE-2026-1557?

Yes, a public proof-of-concept exploit is available for CVE-2026-1557. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-1557?

Within 24 hours: Identify all WordPress instances using WP Responsive Images plugin and disable or deactivate the plugin immediately. Within 7 days: Audit server logs for suspicious access patterns to the plugin's 'src' parameter and review for potential unauthorized file access; conduct a security assessment of exposed sensitive files. Within 30 days: Remove the plugin entirely, switch to an alternative responsive images solution, and implement Web Application Firewall (WAF) rules to block path traversal attempts against any remaining WordPress instances.

WordPress CVE-2026-1557

HIGH

Path Traversal (CWE-22)

2026-02-26 security@wordfence.com

WordPress Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 26, 2026 - 02:16 nvd

HIGH 7.5

DescriptionCVE.org

The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

AnalysisAI

Unauthenticated attackers can exploit a path traversal vulnerability in WP Responsive Images plugin for WordPress (all versions up to 1.0) through the 'src' parameter to read arbitrary files from the server. This allows unauthorized access to sensitive information stored on affected WordPress installations. No patch is currently available.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects WP Responsive Images (WordPress plugin). The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected ProductsAI

Vendor: WordPress. Product: WP Responsive Images (WordPress plugin). Versions: up to 1.0.

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.