CSRF in Filipmedia Wp Image Uploader
CVE-2024-13720
The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gky_image_uploader_main_function() function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.005 (40.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Filipmedia Wp Image Uploader — versions 0
- Ivanm Wp_image_uploader
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@wordfence.com (Third Party Advisory)
- security@wordfence.com (Patch)
Frequently asked questions
- What is CVE-2024-13720?
- CVE-2024-13720 is a high-severity vulnerability in Filipmedia Wp Image Uploader, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2025-01-30.
- How severe is CVE-2024-13720?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2024-13720 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.