Easy Testimonial Slider and Form <= 1.0.31 - Unauthenticated Path Traversal to Arbitrary File Deletion via 'oldcaptcha' Parameter
- ID
- WPSEC-2026-1322
- Plugin
- Easy Testimonial Slider and Form (easy-testimonial-rotator)
- Affected
- all versions before 1.0.32
- Remediation
- Update to 1.0.32 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- Easy Testimonial Slider and Form on WPSec AttackSurface
- Fix released
- Published
Description
The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to path traversal leading to arbitrary file deletion via the 'oldcaptcha' parameter of the etr_get_new_captcha AJAX action in all versions up to, and including, 1.0.31. The plugin passes the user-supplied captcha name to unlink() without checking it, after appending only a '.jpeg' or '.txt' extension. The action is registered for unauthenticated users. Its only protection is a nonce that the [print_best_testimonial_form] shortcode prints on the front end. This makes it possible for unauthenticated attackers to delete arbitrary .jpeg and .txt files that the web server can write, such as media library images, on sites that display the testimonial form.
References
- https://wpsec.com/vuln/WPSEC-2026-1322/
- https://plugins.svn.wordpress.org/easy-testimonial-rotator/tags/1.0.32/
- https://wordpress.org/plugins/easy-testimonial-rotator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS