CVE-2024-10855 Overview
CVE-2024-10855 affects the Image Optimizer, Resizer and CDN – Sirv plugin for WordPress. The vulnerability stems from insufficient validation on the filename parameter of the sirv_upload_file_by_chunks() function. All versions up to and including 7.3.0 are affected. Authenticated attackers with Contributor-level access or higher can delete arbitrary option values on the WordPress site. Removing certain WordPress options triggers errors that deny service to legitimate users. The issue is categorized under [CWE-639] (Authorization Bypass Through User-Controlled Key).
Critical Impact
Contributor-level users can delete arbitrary WordPress options, causing site-wide denial of service and unauthorized data modification.
Affected Products
- Sirv Image Optimizer, Resizer and CDN plugin for WordPress
- Versions up to and including 7.3.0
- WordPress sites permitting Contributor-level registration
Discovery Timeline
- 2024-11-20 - CVE-2024-10855 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10855
Vulnerability Analysis
The vulnerability resides in the sirv_upload_file_by_chunks() function of the Sirv plugin. The function accepts a filename parameter from the request without adequate validation or authorization checks tied to the target resource. An authenticated attacker with Contributor privileges can supply a crafted value that causes the plugin to operate on WordPress option names rather than intended file resources. The result is unauthorized deletion of arbitrary option values from the wp_options table.
Deleting core options such as siteurl, home, template, or stylesheet breaks site rendering and produces fatal errors for anonymous visitors and administrators alike. This produces a denial-of-service condition without requiring further exploitation. The flaw combines a broken access control weakness with insufficient input validation on a state-changing operation.
Root Cause
The root cause is authorization bypass through a user-controlled key, tracked under [CWE-639]. The plugin trusts the client-supplied filename parameter and does not validate that the requester is authorized to act on the resolved target. Insufficient sanitization allows the value to reference sensitive WordPress option names.
Attack Vector
Exploitation requires network access and authenticated Contributor-or-above credentials. The attacker submits a crafted request to the plugin endpoint that invokes sirv_upload_file_by_chunks(), supplying a filename parameter mapped to a critical option name. The plugin processes the request and removes the option, breaking site functionality. Technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Source Code.
No public proof-of-concept exploit is available for CVE-2024-10855 at this time.
Detection Methods for CVE-2024-10855
Indicators of Compromise
- Unexpected HTTP POST requests to Sirv plugin AJAX handlers referencing sirv_upload_file_by_chunks from Contributor-level accounts.
- Missing or empty entries in the wp_options table for critical keys such as siteurl, home, template, or active_plugins.
- Site-wide fatal errors or blank pages appearing shortly after authenticated activity from low-privilege users.
- Unusual filename parameter values in web server access logs targeting the Sirv plugin endpoint.
Detection Strategies
- Audit WordPress activity logs for option deletion events correlated with Contributor or Author accounts.
- Enable database query logging and alert on DELETE operations against wp_options originating from plugin code paths.
- Deploy web application firewall rules that inspect the filename parameter for values matching known WordPress option names.
Monitoring Recommendations
- Monitor plugin versions across all WordPress installations and flag any Sirv version at or below 7.3.0.
- Track failed page loads and PHP fatal errors that follow authenticated plugin activity.
- Review user role assignments regularly to limit the population of Contributor-level accounts with unnecessary access.
How to Mitigate CVE-2024-10855
Immediate Actions Required
- Update the Sirv plugin to a version above 7.3.0 as soon as a patched release is deployed.
- Restrict Contributor and Author account creation, and audit existing low-privilege accounts for legitimacy.
- Back up the wp_options table and full site database to enable rapid recovery from option deletion.
- Deploy a web application firewall rule to block requests targeting sirv_upload_file_by_chunks from non-administrator sessions.
Patch Information
Refer to the WordPress Plugin Change Log for the vendor's remediation commit. Site operators should upgrade to the latest Sirv plugin release, which adds validation on the filename parameter and enforces authorization checks in the affected function.
Workarounds
- Deactivate the Sirv plugin until a patched version is installed if upgrade is not immediately possible.
- Temporarily remove Contributor-and-above roles from untrusted users to eliminate the required privilege for exploitation.
- Apply a WAF virtual patch that blocks requests where the filename parameter matches known WordPress option keys.
- Enable file integrity and database change monitoring to detect and roll back unauthorized option deletions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
