CVE-2021-24644CWE-22

Images to WebP < 1.9 - Authenticated Local File Inclusion

published November 23, 2021

CVSS
—
EPSS
5%
Percentile
92.1
In the wild
Unconfirmed
What it is

The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, which could lead to a Local File Inclusion issue

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04912 · 92.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2021-11-23T19:16Z
EPSS history
Timeline
  • 23 NOV 19:16Z
    Images to WebP < 1.9 - Authenticated Local File Inclusion
    cvelistv5