What’s Vulnerable › Vulnerabilities

CVE-2022-4101: Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 29.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-16 · updated 2026-06-17

Description

The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.

Affected products

• Images Optimize and Upload CF7: through 2.1.4

References

• https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb
• https://wpscan.com/vulnerability/2ce4c837-c62c-41ac-95ca-54bb1a6d1eeb

Get alerted when CVE-2022-4101 or the next vulnerability affects your stack