CVE-2022-4101 Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion
Unauthenticated attackers can delete arbitrary files on the server via path traversal in the Images Optimize and Upload CF7 WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-4101?
CVE-2022-4101 is a critical path traversal vulnerability in Unknown Images Optimize and Upload CF7, published on 16 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.
Which versions are affected by CVE-2022-4101?
It affects 1 product.
Products include Images Optimize and Upload Cf7 Project Images Optimize and Upload Cf7.
How do I fix CVE-2022-4101?
No fix has been published for CVE-2022-4101 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-4101 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4101 exists.
Sources
Also known as GHSA-wvp8-6wrp-jww8.