WP Image Uploader WordPress Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the WP Image Uploader plugin for WordPress, affecting all versions through 1.0.1. The issue arises from inadequate file path validation in the gky_image_uploader_main_function(), enabling unauthenticated attackers to delete arbitrary files on the server. This vulnerability could easily lead to remote code execution if a critical file, such as wp-config.php, is deleted.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion on the server. Deleting certain files, like wp-config.php, could lead to remote code execution.