by Kastro
Paper/Archive/CVE-2022-4101

CVE-2022-4101

Unknown Images Optimize and Upload CF7 — Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion

EPSS 29%public exploitCVSS 9.1
critical.is priorityof 100
57
CVSS 9.1 (NVD, ADP agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 98.2.982 × 2019.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.

Affected

ProductAffectedFixed inSource
Images Optimize and Upload CF7≤ 2.1.4–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitwpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb