CVE-2022-4101

critical · 9.1

The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.

9.1

CVSS

29.4%

EPSS (exploit prob.)

98th

EPSS percentile

2023-01-16

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected products

Vendor	Product	Affected versions
images_optimize_and_upload_cf7_project	images_optimize_and_upload_cf7	<= 2.1.4

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb
https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-4101