CVE-2024-13707 identifies a Cross-Site Request Forgery (CSRF) vulnerability in the WP Image Uploader plugin developed by filipmedia for WordPress. The issue exists in all versions up to and including 1.0.1 due to missing or incorrect nonce validation in the function gky_image_uploader_main_function(). Nonces in WordPress serve as tokens to verify that requests originate from legitimate users and prevent unauthorized actions. The absence or improper implementation of nonce checks allows attackers to craft malicious requests that, when executed by an authenticated administrator (via clicking a link or visiting a crafted page), can trigger unauthorized file deletion operations. This vulnerability does not require the attacker to be authenticated but does require user interaction from an administrator-level user. The impact is severe because arbitrary file deletion can lead to loss of critical data, site defacement, or denial of service. The CVSS v3.1 score of 8.8 reflects network attack vector, low attack complexity, no privileges required, but user interaction needed, with high confidentiality, integrity, and availability impacts. Although no known exploits are reported in the wild, the vulnerability poses a significant risk to WordPress sites using this plugin, especially those with high-privilege users. The lack of available patches at the time of reporting necessitates immediate mitigation efforts.

The vulnerability allows attackers to delete arbitrary files on WordPress sites running the affected WP Image Uploader plugin versions, potentially causing data loss, site downtime, or defacement. This compromises the confidentiality, integrity, and availability of the affected systems. Organizations relying on this plugin risk operational disruption and reputational damage if exploited. Since exploitation requires tricking an administrator into clicking a malicious link, targeted phishing or social engineering campaigns could be used. The broad use of WordPress globally and the plugin's presence in many sites increase the attack surface. The impact is especially critical for organizations with sensitive or business-critical websites, as file deletion could disrupt services or lead to further exploitation by removing security controls or logs.

1. Immediately update the WP Image Uploader plugin to a patched version once available from the vendor. 2. Until a patch is released, implement Web Application Firewall (WAF) rules to detect and block suspicious requests targeting the vulnerable function or URL patterns associated with the plugin. 3. Educate site administrators about the risks of clicking untrusted links, especially when logged into WordPress admin panels. 4. Restrict administrative access to trusted IP addresses or VPNs to reduce exposure. 5. Regularly back up website files and databases to enable recovery in case of file deletion. 6. Monitor logs for unusual deletion requests or anomalies related to the plugin’s operations. 7. Consider temporarily disabling or removing the plugin if it is not essential until a secure version is available. 8. Employ Content Security Policy (CSP) headers to limit the impact of CSRF attacks by restricting the sources of executable scripts and forms.