Path Traversal Vulnerability in Hot Random Image Plugin for WordPress

CVE-2025-4419

What is CVE-2025-4419?

The Hot Random Image plugin for WordPress has a Path Traversal vulnerability that impacts versions up to 1.9.2. It allows authenticated users with Contributor-level access or higher to exploit the 'path' parameter, leading to unauthorized access of arbitrary images outside of the designated directory. This vulnerability may expose sensitive files and could be exploited further if not patched, making it crucial for website owners to update to a secure version.

References