CVE-2024-5853: 
WordPress vulnerability analysis and mitigation

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress contains an arbitrary file upload vulnerability (CVE-2024-5853) due to missing file type validation in the sirvuploadfilebychanks AJAX action in versions up to and including 7.2.6. The vulnerability was discovered and disclosed on June 19, 2024 (Wordfence).

The vulnerability exists due to improper file type validation in the sirvuploadfilebychanks AJAX action. This security flaw allows authenticated attackers with Contributor-level access or higher to upload arbitrary files to the affected WordPress site's server. The vulnerability has been assigned a CVSS v3.1 base score of 9.9 CRITICAL with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (Wordfence).

The vulnerability could enable authenticated attackers to upload malicious files to the server, potentially leading to remote code execution. This poses a significant security risk as attackers could gain unauthorized control over the affected WordPress site (Wordfence).

A fix has been implemented in the plugin's source code as evidenced by the changeset (WordPress Plugin Repo). Users are advised to update to a version newer than 7.2.6 to protect against this vulnerability.