Path Traversal Vulnerability in Hot Random Image Plugin for WordPress

CVE-2025-4419

What is CVE-2025-4419?

The Hot Random Image plugin for WordPress has a Path Traversal vulnerability that impacts versions up to 1.9.2. It allows authenticated users with Contributor-level access or higher to exploit the 'path' parameter, leading to unauthorized access of arbitrary images outside of the designated directory. This vulnerability may expose sensitive files and could be exploited further if not patched, making it crucial for website owners to update to a secure version.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References