CVE-2024-13720

The vulnerability in the WP Image Uploader plugin for WordPress arises from inadequate validation of file paths within the gky_image_uploader_main_function(). This flaw allows unauthorized users to delete arbitrary files on the server, as the plugin does not sufficiently check whether the requested file deletion is legitimate. This lack of validation can be exploited by attackers to target critical files, such as configuration files or other sensitive data, leading to severe consequences, including the potential for remote code execution. The vulnerability exists in all versions up to and including 1.0.1, making it imperative for users of this plugin to assess their risk exposure.

Attack vectors for this vulnerability are particularly concerning due to the ease with which unauthenticated attackers can exploit it. By crafting specific requests to the vulnerable function, an attacker can manipulate the file path to point to sensitive files on the server. For instance, if an attacker successfully deletes the wp-config.php file, they can disrupt the website's functionality and potentially gain access to database credentials and other sensitive information. This exploitation can be executed without any prior authentication, making it accessible to a wide range of attackers, including those with minimal technical skills. The simplicity of this attack vector amplifies the risk associated with the vulnerability.

The real-world impact of this vulnerability can be profound, particularly for businesses relying on WordPress for their online presence. The ability to delete critical files can lead to website downtime, loss of data integrity, and exposure of sensitive information. For organizations that handle customer data or financial transactions, the repercussions can extend beyond immediate operational disruptions to long-term reputational damage and legal liabilities. The potential for remote code execution further escalates the risk, as it could allow attackers to deploy malware, steal data, or even pivot to other systems within the network. The business risk is compounded by the fact that many organizations may not have adequate monitoring or incident response plans in place to address such vulnerabilities swiftly.

To detect and mitigate the risks associated with this vulnerability, organizations should implement a multi-faceted approach. Regularly updating plugins and monitoring for vulnerabilities is crucial; users of the WP Image Uploader plugin should immediately upgrade to the latest version or consider alternative solutions if updates are not available. Additionally, employing web application firewalls (WAFs) can help filter out malicious requests targeting the vulnerable function. Implementing strict file permissions and regularly auditing server configurations can further reduce the attack surface. Organizations should also conduct routine security assessments and penetration testing to identify and remediate vulnerabilities proactively.

In conclusion, the vulnerability in the WP Image Uploader plugin poses a significant threat to WordPress users, particularly due to its potential for arbitrary file deletion and subsequent remote code execution. The ease of exploitation and the severe implications for business operations necessitate immediate attention from affected organizations. By adopting robust detection and mitigation strategies, businesses can better protect themselves against the risks associated with this vulnerability and enhance their overall cybersecurity posture.

Recent adjustments to the CVSS and EPSS scores for CVE-2024-13720 reflect a recalibration of the vulnerability’s exploitability and impact based on evolving threat intelligence. The CVSS score was revised downward from 9.1 to 8.8, indicating a slightly reduced but still high severity level. Concurrently, the EPSS score decreased by over a quarter, signaling a notable reduction in the probability of exploitation in the near term. CSURFACE threat intelligence and our telemetry reveal a declining trend in exploit attempts, with no new proof-of-concept exploits or active campaigns detected. This suggests that while the vulnerability remains critical due to its potential for arbitrary file deletion and remote code execution, immediate exploitation pressure has lessened. For defenders, this update underscores a marginally reduced urgency but does not diminish the need for vigilance, as the vulnerability’s inherent risk persists and could be leveraged by opportunistic threat actors if conditions change. The downward adjustment in risk metrics should inform prioritization strategies but not lead to complacency in patch management or monitoring efforts.

Update 2 — June 13, 2026

The CVSS score for CVE-2024-13720 has been revised upward from 8.8 to 9.1, reflecting a reassessment of the vulnerability’s impact and exploitability. This adjustment signals an increased recognition of the potential severity of arbitrary file deletion in the WP Image Uploader plugin, particularly given the ease with which unauthenticated attackers can trigger this flaw. While our telemetry continues to show no emergence of new exploit techniques or active exploitation campaigns, the elevated score underscores the critical nature of the vulnerability and its capacity to facilitate remote code execution through targeted file deletions such as wp-config.php. For defenders, this change emphasizes the necessity of maintaining high prioritization in patch management and monitoring, as the vulnerability’s exploit potential remains substantial despite stable exploitation trends. The updated risk rating should inform ongoing threat modeling and resource allocation, ensuring that defensive postures remain aligned with the refined severity assessment.