EUVD-2025-18325
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
3Tags
Description
The Image Resizer On The Fly plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' task in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Analysis
The Image Resizer On The Fly WordPress plugin (versions ≤1.1) contains a critical arbitrary file deletion vulnerability in its 'delete' task that allows unauthenticated attackers to remove arbitrary files from the server without authentication. This vulnerability can facilitate remote code execution by deleting critical files such as wp-config.php, leading to complete WordPress installation compromise. With a CVSS score of 9.1 and network-accessible attack vector requiring no user interaction or privileges, this represents a critical risk to all unpatched installations.
Technical Context
The vulnerability stems from insufficient input validation in the plugin's file deletion functionality (CWE-22: Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'). The 'delete' task parameter fails to properly sanitize or validate file paths before deletion operations, allowing attackers to traverse directory structures using path traversal sequences (e.g., '../../../') to reach files outside intended directories. The affected product is the 'Image Resizer On The Fly' plugin for WordPress (CPE: wordpress:image_resizer_on_the_fly), which handles image manipulation and file management. WordPress plugins execute with the same privileges as the WordPress installation, making file deletion a direct path to system compromise. The vulnerability exists because the plugin does not implement proper whitelist validation, canonicalization, or chroot jailing of file paths before performing delete operations.
Affected Products
- vendor: wordpress; product: image_resizer_on_the_fly; versions: up to and including 1.1; affected_scope: All installations; cpe: cpe:2.3:a:wordpress:image_resizer_on_the_fly:*:*:*:*:*:wordpress:*:*
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today