WordPress Plugin Vulnerabilities

Smush Image Compression and Optimization < 3.17.1 - Admin+ Directory Traversal

Description

The plugin is vulnerable to Directory Traversal, making it possible for authenticated attackers, with Administrator-level access and above, to perform actions on files outside of the originally intended directory.

Affects Plugins

Plugin icon
wp-smushit
Fixed in 3.17.1

References

CVE
CVE-2025-22288
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4c92dd-a605-42b5-af10-0a0e25461dde

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
2.7 (low)

Miscellaneous

Original Researcher
SteveSec
Verified
No
WPVDB ID
7ca01ae4-abf8-4cf5-9fb0-0dbd836aa62d

Timeline

Publicly Published
2025-03-29 (about 1 year ago)
Added
2025-04-10 (about 1 year ago)
Last Updated
2025-04-10 (about 1 year ago)

Other

Published
Title
Published
2026-04-16
Title
JetBackup < 3.1.20.3 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter
Published
2024-06-06
Title
Qi Addons For Elementor < 1.7.3 - Authenticated (Contributor+) Local File Inclusion
Published
2025-01-30
Title
Music Sheet Viewer <= 4.1 - Unauthenticated Arbitrary File Read
Published
2025-09-16
Title
StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More < 1.5.1 - Authenticated (Subscriber+) Arbitrary File Download
Published
2021-06-23
Title
WP Image Zoom < 1.47 - Local File Inclusion