Directory traversal

2024-01-1107:15:00

PRIOn knowledge base

www.prio-n.com

directory traversal

wordpress

image optimizer

vulnerability

unauthenticated attackers

arbitrary files

sensitive information

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

40.6%

JSON

The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

CPENameOperatorVersion
wp_compressle6.10.33

CPE	Name	Operator	Version
	wp_compress	le	6.10.33

References

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3009183%40wp-compress-image-optimizer%2Ftrunk&old=2994665%40wp-compress-image-optimizer%2Ftrunk&sfp_email=&sfph_mail=

www.wordfence.com/threat-intel/vulnerabilities/id/defb87dd-bf5f-411f-b948-699337d05d44?source=cve