CVE-2023-2117: 
WordPress vulnerability analysis and mitigation

CVE-2023-2117 is a path traversal vulnerability affecting the WordPress plugin Image Optimizer by 10web versions below 1.0.27. The vulnerability was discovered and publicly disclosed on May 2, 2023. This security issue affects websites running the vulnerable versions of the Image Optimizer plugin (WPScan).

The vulnerability exists due to improper sanitization of the 'dir' parameter when handling the get_subdirs ajax action. This allows high-privileged users such as administrators to inspect names of files and directories outside of the site's root. The vulnerability has been assigned a CVSS score of 4.1 (medium severity) and is classified as a Path Traversal vulnerability (CWE-22) (WPScan).

When exploited, this vulnerability allows authenticated users with administrative privileges to view file and directory names outside of the WordPress installation's root directory, potentially exposing sensitive information about the server's file system (WPScan).

The vulnerability has been fixed in version 1.0.27 of the Image Optimizer by 10web plugin. Website administrators are advised to update to this version or later to mitigate the security risk (WPScan).