Skip to content
Sign in
2.7 Low

CVE-2023-2117 The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the…

Description

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.

Affected products and versions

Product Affected versions Fixed in
Image Optimizer by 10web 1.0 earliest → < 1.0.27 1.0.27

Other CVEs of Image Optimizer by 10web

The 2 CVEs of Image Optimizer by 10web →
CVE-2023-2122 The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active… Not rated
Track this CVE