CVE-2022-4101

The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb	Exploit Third Party Advisory
https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:images_optimize_and_upload_cf7_project:images_optimize_and_upload_cf7:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 07:34

Type	Values Removed	Values Added
References	~~() https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb - Exploit, Third Party Advisory~~	() https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb - Exploit, Third Party Advisory
Summary		(es) El complemento Images Optimize and Upload CF7 de WordPress hasta la versión 2.1.4 no valida el archivo que se eliminará mediante una acción AJAX disponible para usuarios no autenticados. Esto podría permitirles eliminar archivos arbitrarios en el servidor mediante un ataque de path traversal.

Information

Published : 2023-01-16 16:15

Updated : 2025-04-04 19:15

NVD link : CVE-2022-4101

Mitre link : CVE-2022-4101

CVE.ORG link : CVE-2022-4101

JSON object : View

Products Affected

images_optimize_and_upload_cf7_project

images_optimize_and_upload_cf7

CWE

No CWE.

{"id": "CVE-2022-4101", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2023-01-16T16:15:11.070", "references": [{"url": "https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "descriptions": [{"lang": "en", "value": "The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack."}, {"lang": "es", "value": "El complemento Images Optimize and Upload CF7 de WordPress hasta la versi\u00f3n 2.1.4 no valida el archivo que se eliminar\u00e1 mediante una acci\u00f3n AJAX disponible para usuarios no autenticados. Esto podr\u00eda permitirles eliminar archivos arbitrarios en el servidor mediante un ataque de path traversal."}], "lastModified": "2025-04-04T19:15:42.527", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:images_optimize_and_upload_cf7_project:images_optimize_and_upload_cf7:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "53EE002D-6784-4F1F-A7EE-C9B976B7143E", "versionEndIncluding": "2.1.4"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}