CVE-2024-10855: Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the filename parameter of the sirvuploadfilebychunks() function and lack of in all versions up to, and including, 7.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10855?
CVE-2024-10855 has a high severity rating due to its potential to cause denial of service and unauthorized data modification.
How do I fix CVE-2024-10855?
To fix CVE-2024-10855, update the Sirv plugin for WordPress to the latest version beyond 7.3.1 that addresses this vulnerability.
What are the potential impacts of CVE-2024-10855?
The potential impacts of CVE-2024-10855 include unauthorized data modification and a denial of service that can disrupt website functionality.
Which versions are affected by CVE-2024-10855?
All versions of the Sirv plugin for WordPress prior to version 7.3.2 are affected by CVE-2024-10855.
Is there a workaround for CVE-2024-10855?
Currently, there are no specific workarounds for CVE-2024-10855, and upgrading the plugin is recommended.