Arbitrary File Deletion in Image Resizer On The Fly Plugin for WordPress

CVE-2025-6065

What is CVE-2025-6065?

The Image Resizer On The Fly plugin for WordPress suffers from a vulnerability that allows unauthenticated attackers to exploit insufficient file path validation in the 'delete' task. This security flaw exists in all versions up to and including 1.1, enabling attackers to delete arbitrary files on the server. If a sensitive file such as wp-config.php is targeted, this can lead to severe consequences including potential remote code execution.

References