CVE-2026-1557 is a path traversal vulnerability in the WP Responsive Images plugin for WordPress, affecting all versions up to and including 1.0. The vulnerability arises from improper limitation of a pathname to a restricted directory via the 'src' parameter, enabling unauthenticated attackers to read arbitrary files on the server. This can lead to disclosure of sensitive information. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the server hosting the vulnerable plugin. This can lead to disclosure of sensitive information, potentially compromising confidentiality. There is no impact on integrity or availability reported. The vulnerability is rated high severity based on CVSS 3.1 scoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the WP Responsive Images plugin to prevent exploitation. Monitor vendor channels for updates or patches addressing this vulnerability.