The vulnerability identified as CVE-2024-8480 affects the Sirv Image Optimizer, Resizer and CDN plugin for WordPress, present in all versions up to and including 7.2.7. The core issue is a missing authorization check (CWE-862) in the 'sirv_save_prevented_sizes' function, which fails to verify whether the authenticated user has sufficient privileges to perform certain actions. Attackers with Contributor-level access or higher can exploit this by leveraging the 'sirv_upload_file_by_chunks_callback' function, which does not properly validate uploaded file types. This flaw allows arbitrary file uploads to the web server, potentially enabling remote code execution (RCE) if malicious files such as web shells are uploaded. The vulnerability requires authentication but no additional user interaction, and the attack surface includes any WordPress site using the affected plugin versions. The CVSS v3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patches or exploit reports are currently available, but the risk remains significant due to the plugin’s widespread use in WordPress environments for image optimization and CDN services.

Organizations running WordPress sites with the vulnerable Sirv plugin face significant risks including unauthorized data modification, server compromise, and full site takeover through remote code execution. Attackers with low-level authenticated access (Contributor role) can escalate privileges by uploading malicious files, potentially leading to data breaches, defacement, malware distribution, or pivoting to internal networks. The impact extends to confidentiality (data exposure), integrity (unauthorized changes), and availability (service disruption). Given WordPress’s popularity and the plugin’s role in media handling, this vulnerability could affect a broad range of industries including e-commerce, media, education, and government websites. The ease of exploitation and high impact make it a critical threat to web infrastructure security worldwide.

Immediate mitigation involves updating the Sirv plugin to a version that addresses this vulnerability once available. Until a patch is released, organizations should restrict Contributor-level user permissions, limiting upload capabilities and reviewing user roles carefully. Implementing web application firewall (WAF) rules to detect and block suspicious file uploads targeting the vulnerable endpoints can reduce risk. Additionally, disabling or restricting the plugin’s upload functionality temporarily may be necessary. Monitoring server logs for unusual file upload activity and scanning for web shells or unauthorized files is recommended. Employing file integrity monitoring and strict file type validation at the server level can provide additional defense layers. Finally, educating administrators about the risks of granting Contributor or higher privileges without strict controls is essential.