CVE-2024-13720 is a high severity (CVSS 8.8) arbitrary file deletion in the WP Image Uploader plugin for WordPress, in versions up to and including 1.0.1. The record says deleting the right file, such as wp-config.php, can lead to remote code execution. Remove the plugin or find a fixed release.
What's affected
- WP Image Uploader, all versions up to and including 1.0.1.
The record does not name a fixed version. Check the plugin page and changelog for a release newer than the last affected version before relying on an update.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i image-uploader
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Check for a release newer than 1.0.1. If there is none, deactivate and delete the plugin.
- Use another image upload method with active maintenance.
- Keep offsite backups, including wp-config.php, and monitor file integrity.
- Look up CVE-2024-13720 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The record lists path traversal (CWE-22) and cross-site request forgery (CWE-352). The flaw is in gky_image_uploader_main_function(), where file path validation is insufficient. Deleting wp-config.php puts WordPress back into its setup state, which is how a deletion bug becomes a takeover.
The vector shows low privileges required, so some account is needed, though user interaction is not.
This CVE is an arbitrary file deletion flaw (CWE-22, CWE-352, Path Traversal and Cross-Site Request Forgery). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
Path validation bugs let a visitor steer a file operation toward a location the developer never intended. Here the operation is deletion and the check on the supplied path is too weak.
The fix pattern is to resolve the path, confirm it stays inside the intended folder, and ignore anything else. A server side mapping from an ID to a file is safer than any path from the browser.
Quick check
Why is wp-config.php mentioned?
Per the record, deleting it can easily lead to remote code execution.
Is there a patched version?
The record names none. Check the plugin page, and remove the plugin if nothing newer exists.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
