A critical path traversal vulnerability in the WP Responsive Images plugin allows unauthenticated attackers to access sensitive server files, posing a significant risk to data confidentiality.

This vulnerability is a path traversal flaw (CWE-22) residing in the image processing logic of the plugin. Unauthenticated attackers can exploit the src parameter to bypass directory restrictions and read arbitrary files from the underlying server filesystem.

The ability for an unauthenticated user to read arbitrary files can lead to the exposure of sensitive configuration data, database credentials, and internal system files. Given the CVSS score of 7.5, this high severity vulnerability represents a direct threat to the confidentiality of the entire WordPress environment and potentially the integrity of the hosting infrastructure.

Immediate Action: As no patched version is currently available, administrators should immediately deactivate and remove the WP Responsive Images plugin from their WordPress installations until a secure update is released by the vendor.

Proactive Monitoring: Security teams should monitor server access logs for anomalous requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at image handling endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing path traversal characters in the src parameter to provide temporary protection against exploitation attempts.

Public Exploit Available: Unknown.

Due to the lack of a verified patch and the high risk associated with unauthorized file disclosure, immediate removal of the plugin is the only effective mitigation. Organizations should prioritize decommissioning the affected component to prevent potential data exfiltration and maintain the security posture of their web applications.