CVE-2024-13720 is a vulnerability classified under CWE-352 (Cross-Site Request Forgery) affecting the WP Image Uploader plugin for WordPress, specifically in all versions up to and including 1.0.1. The root cause is insufficient validation of file paths within the gky_image_uploader_main_function(), which allows an attacker to craft malicious requests that delete arbitrary files on the server. Since the vulnerability can be exploited without authentication and does not require user interaction, an attacker can remotely send specially crafted HTTP requests to the vulnerable endpoint to delete critical files. Deleting files such as wp-config.php can disrupt the WordPress installation or enable remote code execution by forcing the system into an unstable state or allowing attackers to upload malicious files subsequently. The vulnerability has a CVSS v3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no user interaction, and impacts on confidentiality, integrity, and availability. No patches or official fixes are currently linked, and no known exploits have been observed in the wild, but the potential for severe damage is significant. The vulnerability highlights the importance of proper input validation and CSRF protections in WordPress plugins.

The impact of CVE-2024-13720 is substantial for organizations running WordPress sites with the WP Image Uploader plugin. Successful exploitation can lead to arbitrary file deletion, which threatens the integrity and availability of the website and underlying server. Critical files like wp-config.php, if deleted, can cause site outages or enable attackers to gain remote code execution capabilities, potentially leading to full server compromise. This can result in data breaches, defacement, loss of customer trust, and significant downtime. Since the vulnerability requires no authentication and can be exploited remotely, attackers can target a wide range of organizations, including small businesses, e-commerce sites, and large enterprises relying on WordPress. The ease of exploitation combined with the critical nature of the affected files means that the threat could be leveraged for ransomware deployment, data theft, or persistent backdoors.

1. Immediate mitigation involves disabling or uninstalling the WP Image Uploader plugin until a patch is released. 2. Implement Web Application Firewall (WAF) rules to detect and block suspicious requests targeting the vulnerable function or file deletion patterns. 3. Restrict file system permissions to limit the plugin's ability to delete critical files, ensuring the web server user has minimal privileges. 4. Employ CSRF tokens and verify them on all state-changing requests to prevent unauthorized actions. 5. Monitor server logs for unusual DELETE or POST requests that could indicate exploitation attempts. 6. Regularly back up WordPress files and databases to enable quick recovery if files are deleted. 7. Keep WordPress core, themes, and plugins updated and subscribe to security advisories for timely patching. 8. Conduct security audits and penetration testing focusing on plugin vulnerabilities and file system access controls.