Discovering and Responsibly Disclosing a Path Traversal Vulnerability in a WordPress Plugin

During a security analysis of the Easy Testimonial Slider and Form WordPress plugin, I discovered a Path Traversal vulnerability associated with its CAPTCHA file deletion functionality.

🔍 The Vulnerability

The issue was related to insufficient file path validation during the CAPTCHA cleanup process. Under certain conditions, this flaw could potentially allow unauthorized deletion of files outside the intended directory.

🛠️ Responsible Disclosure

After identifying the vulnerability, I reported it directly to the plugin's development team. The developers responded promptly and took steps to address the issue.

✅ Security Update

The vulnerability has been fixed in version 1.0.32 of the plugin.

If you are using this plugin on your WordPress website, it is recommended that you update to version 1.0.32 or later to benefit from the security fix.

🙏 Acknowledgements

I would like to thank the plugin's development team for their prompt response, professional approach, and cooperation throughout the responsible disclosure process.

Security research is not just about discovering vulnerabilities. It is also about helping developers improve their products and making the internet a safer place for everyone.

Thank you for reading!