CVE-2026-1557

WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src

CVSS 7.5 HIGHEPSS 1.7%CWE-22

Vexday Risk Score

36Atenção

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

CVSS 7.5EPSS 1.7%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

26 fev 2026Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

stuartbates · WP Responsive Images

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/image_handler.php#L28 https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/SBOutputFile.php#L33 https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/WPResponsiveImages.php#L265 https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/image_handler.php#L28 https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/SBOutputFile.php#L33 https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/WPResponsiveImages.php#L265 https://www.wordfence.com/threat-intel/vulnerabilities/id/22c6f81b-d456-44b9-ba6c-8b207a9ee6e1?source=cve