ShortPixel Image Optimizer Path Traversal Vulnerability Allowing Arbitrary File Read

A path traversal vulnerability allowing arbitrary file read has been identified in the ShortPixel Image Optimizer plugin for WordPress, affecting all versions through 6.4.2. This vulnerability arises from inadequate path validation and sanitization in the 'loadLogFile' AJAX action, enabling authenticated attackers with Editor-level access or higher to read arbitrary files on the server. Such files may contain sensitive information, including database credentials and authentication keys.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server, potentially exposing critical information such as database credentials and authentication keys.

Reproduction

To reproduce this vulnerability, an authenticated user with Editor-level access or higher can send a request to the 'loadLogFile' AJAX action, including a crafted 'loadFile' parameter that exploits the path traversal flaw. This request can be made through the WordPress admin interface or via a custom script that interacts with the WordPress AJAX API.

Remediation

Users are advised to update the ShortPixel Image Optimizer plugin to version 6.4.3 or a newer patched version.