Description

WordPress Plugin Image Optimizer by 10web-Image Optimizer and Compression is prone to a directory traversal vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Image Optimizer by 10web-Image Optimizer and Compression version 1.0.25 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.0.26 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/image-optimizer-wd/image-optimizer-by-10web-1025-directory-traversal-to-information-exposure

https://plugins.svn.wordpress.org/image-optimizer-wd/trunk/readme.txt

Related Vulnerabilities

PrestaShop Improper Neutralization of Formula Elements in a CSV File Vulnerability (CVE-2021-21302)

Joomla! Core 2.5.x Cross-Site Scripting (2.5.0 - 2.5.18)

WordPress Plugin easyping-website subscriptions done right PHP Object Injection (0.0.1)

WordPress Plugin FireStorm Professional Real Estate Multiple SQL Injection Vulnerabilities (2.05.01)

WordPress Plugin Collision Testimonials 'admin.php' SQL Injection (3.0)

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Directory Traversal