WordPress Image Shadow Plugin <= 1.1.0 - Arbiträre Dateilöschungs-Schwachstelle

The Arbitrary File Access vulnerability allows an attacker to bypass intended access controls and read arbitrary files on the server. Successful exploitation could lead to the disclosure of sensitive configuration files, database credentials, or even source code. The impact is amplified in shared hosting environments where multiple websites reside on the same server, potentially exposing data from other tenants. While no direct precedent exists for Image Shadow specifically, path traversal vulnerabilities are frequently exploited to gain unauthorized access and escalate privileges, similar to attacks targeting other WordPress plugins with inadequate file access controls.

WordPress websites utilizing the Image Shadow plugin, particularly those running older versions (0.0.0–1.1.0), are at risk. Shared hosting environments where users have limited control over plugin installations are also particularly vulnerable.

• wordpress / composer / npm:

grep -r "../" /var/www/html/wp-content/plugins/image-shadow/

• generic web:

curl -I http://your-wordpress-site.com/wp-content/plugins/image-shadow/../../../../etc/passwd | head -n 1

1. 2025-06-27Disclosure

   disclosure

1. Reserviert2025-01-23
2. Veröffentlicht2025-06-27
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-24765 is to immediately upgrade the Image Shadow plugin to version 1.1.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Additionally, restrict file permissions on sensitive directories to prevent unauthorized access. Regularly review WordPress plugin installations and ensure they are from trusted sources.