WP Image Uploader WordPress Plugin Cross-Site Request Forgery Vulnerability Allowing Arbitrary File Deletion

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WP Image Uploader plugin for WordPress, affecting all versions through 1.0.1. The issue arises from inadequate nonce validation in the gky_image_uploader_main_function(), allowing unauthenticated attackers to delete arbitrary files by sending a forged request. This exploitation requires tricking a site administrator into performing an action, such as clicking a link.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of files on the affected WordPress site.

Remediation

No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.