Vulnerabilities

TI-2024-12746 CVE-2024-13707 · GHSA-rv52-9m39-w8gf

WP Image Uploader <= 1.0.1 - Cross-Site Request Forgery to Arbitrary File Deletion

MEDIUM 40

The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00244 Published 2025-01-30 No fix listed CWE-352

TI-2024-12759 CVE-2024-13720 · GHSA-mpf5-4599-xvw2

WP Image Uploader <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion

MEDIUM 42

The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gky_image_uploader_main_function() function in all versions up to, and including, 1.0.1.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0054 Published 2025-01-30 No fix listed CWE-352

Vulnerabilities

Filters

WP Image Uploader <= 1.0.1 - Cross-Site Request Forgery to Arbitrary File Deletion

WP Image Uploader <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion