Images to WebP < 1.9 - Authenticated Local File Inclusion
Priority MEDIUM 42CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, which could lead to a Local File Inclusion issue
Why it matters now
EPSS 0.05875 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Images to WebP (Unknown): 1.9
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Images to WebP | 1.9 to before 1.9 | 1.9 | Patch available | CNA |
- Images to WebP VendorUnknown Affected 1.9 to before 1.9 Fixed in 1.9 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:imagestowebp_project:images_to_webp:*:*:*:*:*:wordpress:*:* | before 1.9 | Vulnerable | Imagestowebp Project |
- cpe:2.3:a:imagestowebp_project:images_to_webp:*:*:*:*:*:wordpress:*:* Versions before 1.9 Vulnerable ·Imagestowebp Project
Remediation
- Fix · CNA Images to WebP (Unknown) Fixed in 1.9
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Images to WebP 1.9
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-06924 Images to WebP < 1.9 - Multiple Cross Site Request Forgery (CSRF)Priority LOW 36
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24644
- 2026-10-03 Alias added: GHSA-4524-hxm7-m92p
References
More Imagestowebp Project Images To Webp vulnerabilities
- TI-2021-06924 Images to WebP < 1.9 - Multiple Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.1
Sources
- CVE-2021-24644 · CVE Program
- CVE-2021-24644 · NVD
- FIRST EPSS
- GHSA-4524-hxm7-m92p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences