CVE-2026-1557

WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src

CVSS 7.5 HIGHEPSS 1.7%CWE-22

Vexday Risk Score

36Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

CVSS 7.5EPSS 1.7%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

26 feb 2026Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Productos afectados

stuartbates · WP Responsive Images

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/image_handler.php#L28 https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/SBOutputFile.php#L33 https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/WPResponsiveImages.php#L265 https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/image_handler.php#L28 https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/SBOutputFile.php#L33 https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/WPResponsiveImages.php#L265 https://www.wordfence.com/threat-intel/vulnerabilities/id/22c6f81b-d456-44b9-ba6c-8b207a9ee6e1?source=cve