CVE-2022-4101

PoC —

CVSS 3.1

9.1 critical

EPSS

29%p98

Published

Jan 16, 2023 (Jan 16, 2023)

Modified

Jun 17, 2026

Description

The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.

Vendors: images optimize and upload cf7 project
Products: images optimize and upload cf7
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (29.4%)

In the news0 stories

No ingested article mentions this CVE yet.