← Back to CVEs
CVE-2026-1557
HIGH7.5
Description
The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
CVE Details
CVSS v3.1 Score7.5
SeverityHIGH
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
Published2/26/2026
Last Modified2/27/2026
Sourcenvd
Honeypot Sightings0
Weaknesses (CWE)
CWE-22
References
https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/SBOutputFile.php#L33(security@wordfence.com)
https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/WPResponsiveImages.php#L265(security@wordfence.com)
https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/image_handler.php#L28(security@wordfence.com)
https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/SBOutputFile.php#L33(security@wordfence.com)
https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/WPResponsiveImages.php#L265(security@wordfence.com)
https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/image_handler.php#L28(security@wordfence.com)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.