CVE-2022-4101

Published: Jan 16, 2023Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.

Affected (1)

Products: Images Optimize And Upload Cf7 Project: Images Optimize And Upload Cf7

Images Optimize And Upload Cf7 Project

1 product

Images Optimize And Upload Cf7

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Images Optimize And Upload Cf7 Project Images Optimize And Upload Cf7	Up to 2.1.4

References (2)

https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.