CVE-2025-24765 Overview
CVE-2025-24765 is a path traversal vulnerability in the RobMarsh Image Shadow plugin for WordPress. The flaw affects all versions up to and including 1.1.0. An authenticated attacker with low privileges can traverse outside the plugin's intended directory and delete arbitrary files on the server. According to the Patchstack advisory, the issue enables arbitrary file deletion, which can be leveraged to disrupt site availability or facilitate follow-on compromise. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Critical Impact
Authenticated attackers can delete arbitrary files on the WordPress host, potentially disabling the site or enabling remote code execution by removing security controls such as wp-config.php.
Affected Products
- RobMarsh Image Shadow plugin for WordPress
- All versions from n/a through 1.1.0
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2025-06-27 - CVE-2025-24765 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24765
Vulnerability Analysis
The Image Shadow plugin fails to properly sanitize user-supplied file path parameters before performing file system operations. The plugin accepts a path input intended to reference an image within its own directory, but does not restrict traversal sequences such as ../. An authenticated user submits a crafted path that resolves outside the plugin directory, and the plugin proceeds to delete the referenced file.
The Patchstack advisory categorizes this as an arbitrary file deletion vulnerability. Deleting sensitive WordPress files such as wp-config.php triggers the WordPress installation flow, which an attacker can use to bind the site to an attacker-controlled database and achieve remote code execution.
Root Cause
The root cause is missing pathname canonicalization and directory containment checks in the file deletion handler. The plugin trusts input passed from a privileged action without validating that the resolved absolute path stays within an allowed base directory. Standard mitigations such as realpath() comparisons or basename() filtering are absent.
Attack Vector
Exploitation requires network access to the WordPress admin interface and an authenticated account with contributor-level or higher privileges. The attacker issues a request to the vulnerable plugin endpoint with a file or equivalent parameter containing traversal sequences. The scope is changed because deletion affects files outside the plugin's security boundary, and availability impact is high due to potential loss of core site files.
No public proof-of-concept is available in the referenced sources. Refer to the Patchstack WordPress Vulnerability Advisory for further technical detail.
Detection Methods for CVE-2025-24765
Indicators of Compromise
- Unexpected deletion of files outside wp-content/plugins/image-shadow/, particularly wp-config.php or theme files
- HTTP POST requests to Image Shadow AJAX or admin endpoints containing ../ or URL-encoded %2e%2e%2f sequences in file parameters
- WordPress installation prompts appearing on a previously configured site
- New administrator accounts created shortly after suspicious file-delete requests
Detection Strategies
- Enable WordPress plugin file integrity monitoring and alert on deletion of files outside the plugin's own directory
- Inspect web server access logs for requests to admin-ajax.php referencing the Image Shadow plugin with traversal patterns
- Correlate authenticated low-privilege user sessions with subsequent file system deletion events
Monitoring Recommendations
- Monitor wp-content/ and WordPress root for unauthorized file deletions using file integrity monitoring tools
- Alert on HTTP request parameters containing ..%2f, ..%5c, or literal ../ sequences targeting plugin endpoints
- Track contributor and author account activity for unusual administrative or file-management actions
How to Mitigate CVE-2025-24765
Immediate Actions Required
- Deactivate and remove the Image Shadow plugin until a patched release is confirmed by the vendor
- Audit WordPress user accounts and reduce privileges for accounts that do not require content contribution rights
- Verify integrity of wp-config.php and core WordPress files, restoring from backup if tampering is detected
Patch Information
No fixed version is listed in the referenced advisory. All versions up to and including 1.1.0 remain vulnerable. Monitor the Patchstack WordPress Vulnerability Advisory and the plugin's WordPress.org listing for a security release.
Workarounds
- Remove the Image Shadow plugin from all WordPress installations until a vendor patch is released
- Apply a web application firewall rule that blocks requests containing directory traversal sequences targeting the plugin's endpoints
- Restrict file system permissions so the web server user cannot delete WordPress core files such as wp-config.php
# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate image-shadow
wp plugin delete image-shadow
# Harden wp-config.php against deletion by the web server user
chown root:root wp-config.php
chmod 440 wp-config.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
