The Image Resizer On The Fly plugin for WordPress suffers from a CWE-22 path traversal vulnerability that enables unauthenticated attackers to delete arbitrary files on the server. This occurs because the plugin fails to properly restrict file paths in its 'delete' task, allowing traversal outside intended directories. Deletion of critical files such as wp-config.php can facilitate remote code execution. The vulnerability affects all versions up to and including 1.1. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity and availability. No patch or official fix has been documented yet.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the affected server, potentially leading to remote code execution if critical files are removed. This compromises the integrity and availability of the system. The vulnerability does not directly impact confidentiality. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality, disable or remove the plugin if not essential, and monitor for suspicious activity related to file deletions. Avoid exposing the WordPress admin or plugin endpoints to untrusted networks.