The Image Resizer On The Fly plugin contains insufficient file path validation in its delete operation, allowing any visitor to trigger deletion of arbitrary files on the server. This flaw could be exploited to remove critical configuration files such as wp-config.php, thereby enabling an attacker to execute arbitrary code on the host. The weakness is a classic path traversal or directory traversal attack (CWE-22). The impact is loss of confidentiality, integrity, and availability, and can result in full control of the site if a key file is removed or replaced.

WordPress sites that have the wework4web Image Resizer On The Fly plugin installed in any version up to and including 1.1. The plugin is distributed via the WordPress Plugin Repository and is commonly used on production and staging sites built with WordPress.

With a CVSS score of 9.1 the vulnerability is considered critical, and the EPSS score of 7% indicates that exploitation is reasonably likely. The flaw is not listed in the CISA KEV catalog, but its nature allows unauthenticated attackers to trigger the delete action via an HTTP request to the plugin’s delete endpoint; based on the description, it is inferred that this is the attack vector. Once a sensitive file is removed or replaced, the attacker can leverage the resulting misconfiguration to run arbitrary code.