The Image Resizer On The Fly WordPress plugin fails to validate file paths when executing its delete operation. This flaw allows any visitor to instruct the server to delete arbitrary files, including critical system files such as wp-config.php. Removing or replacing key configuration files can compromise site integrity and enable remote code execution. The weakness is classified as a path or directory traversal flaw (CWE-22).

WordPress installations that have the wework4web Image Resizer On The Fly plugin installed in any version up to and including 1.1. The plugin is distributed through the official WordPress Plugin Repository.

With a CVSS score of 9.1 the vulnerability is considered critical. The EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the deletion by sending an unauthenticated HTTP request to the plugin’s delete endpoint, after which the removal of a key file can be leveraged to execute arbitrary code.