PoC Index

CVE-2022-4101

CRITICAL 9.1EPSS 29.4%

The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.

CVSS v3.1
9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v3.1
9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS
29.37% chance of exploitation in the next 30 days, 98th percentile
Published
2023-01-16
Updated
2025-04-04

Proof-of-concept exploits (1)

References

Related