CVE-2024-13707: 
WordPress vulnerability analysis and mitigation

The WP Image Uploader plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.0.1. The vulnerability was disclosed on January 30, 2025, and has been assigned CVE-2024-13707 (NVD).

The vulnerability stems from missing or incorrect nonce validation in the gky_image_uploader_main_function() function. The issue has received a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H from NVD, while Wordfence assigned a slightly higher score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows unauthenticated attackers to delete arbitrary files from the affected WordPress installation, provided they can trick a site administrator into performing specific actions such as clicking on a malicious link (NVD).

The vulnerability requires user interaction to be exploited, specifically requiring a site administrator to be tricked into clicking on a malicious link. The attack can be executed remotely by an unauthenticated attacker (NVD).

Users should update their WP Image Uploader plugin to a version newer than 1.0.1 if available. The vulnerability has been patched, as indicated by the reference to the source code fix (WordPress Patch).