Security Alert Summary
The WP Responsive Images plugin for WordPress contains a path traversal vulnerability via the src parameter that can allow unauthenticated attackers to read arbitrary files on the server. The vulnerability affects all versions up to and including 1.0 and may expose sensitive information stored in files accessible to the web server.
CVE Details
- CVE ID: CVE-2026-1557
- Affected component: WP Responsive Images plugin for WordPress
- Affected versions: All versions up to, and including, 1.0
- Published: February 26, 2026 at 2:16:19 AM UTC
- Last modified: February 26, 2026 at 2:16:19 AM UTC
-
CVSS v3.1:
- Base score: 7.5
- Severity: HIGH
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Authentication requirements: None (unauthenticated)
- Privileges required: None
- User interaction: None
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-22 (Path Traversal)
Technical Details
The plugin accepts a src parameter that is susceptible to path traversal. By manipulating this parameter, an attacker can cause the plugin to return the contents of arbitrary files on the server that are reachable by the web process. The CVE references implementation files where the vulnerable handling occurs, including SBOutputFile.php, WPResponsiveImages.php, and image_handler.php, indicating the request handling and output logic do not properly validate or sanitize the provided src value.
Because the flaw is an information disclosure (arbitrary file read) and requires no authentication or user interaction, an attacker can remotely retrieve files such as configuration files, backups, or other sensitive data that the web server can read. The vulnerability exists due to insufficient path validation/sanitization for the input parameter used to locate or read files.
How This Could Impact Your Website
Imagine a small team managing a WordPress site: the site owner, an internal content editor, and an external contractor who uploads images. If the site uses the affected plugin versions, an unauthenticated attacker could craft requests that retrieve files from the server. Those files might contain configuration details, API keys, or internal user data such as email lists. Exposure of email addresses and other sensitive data increases the risk of targeted phishing or social engineering against staff and contributors.
The impact is focused on confidentiality — attackers may read sensitive files — and does not by itself indicate modification of site content or service disruption. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (If no patched version is listed in the CVE entry, monitor the plugin source and security advisories.)
- Review and reduce unnecessary user roles, especially contributors and accounts with upload privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and access logs for unusual behavior, including requests that attempt directory traversal patterns.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/SBOutputFile.php#L33
- https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/WPResponsiveImages.php#L265
- https://plugins.trac.wordpress.org/browser/wp-responsive-images/tags/1.0/image_handler.php#L28
- https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/SBOutputFile.php#L33
- https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/WPResponsiveImages.php#L265
- https://plugins.trac.wordpress.org/browser/wp-responsive-images/trunk/image_handler.php#L28
- https://www.wordfence.com/threat-intel/vulnerabilities/id/22c6f81b-d456-44b9-ba6c-8b207a9ee6e1?source=cve
