CVE-2024-13720 is a high-severity vulnerability in the WP Image Uploader WordPress plugin (versions up to 1.0.1) caused by insufficient validation of file paths in the gky_image_uploader_main_function(). This flaw enables unauthenticated attackers to perform arbitrary file deletion on the server, which can escalate to remote code execution if key files such as wp-config.php are removed. The vulnerability is related to CWE-352 (Cross-Site Request Forgery), indicating that the attack can be triggered via forged requests without user interaction. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented, and the plugin is not a cloud service, so remediation depends on the vendor or user action.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the affected server hosting the WordPress site. This can lead to severe consequences including remote code execution if critical files like wp-config.php are deleted, potentially compromising the entire site and server. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the WP Image Uploader plugin to prevent exploitation. Monitoring for unusual file deletions and restricting access to the plugin's functionality may help reduce risk, but no vendor-provided mitigation is currently documented.