CVE-2024-13707
Published: 30 January 2025
Description
The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the gky_image_uploader_main_function() function. This makes it possible for unauthenticated attackers to delete arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Security Summary
CVE-2024-13707 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting the WP Image Uploader plugin for WordPress in all versions up to and including 1.0.1. The issue arises from missing or incorrect nonce validation in the gky_image_uploader_main_function() function, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability by tricking a site administrator into performing an action, such as clicking on a malicious link. A successful forged request allows the attacker to delete arbitrary files on the targeted WordPress site.
Advisories, including the Wordfence threat intelligence report, provide further details on the vulnerability. The plugin's source code on the WordPress trac repository identifies the issue at line 85 in index.php.
Details
- CWE(s)