CVE-2014-8799: DukaPress WordPress plugin path traversal in dp_img_resize

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote file read with public exploit code and very high EPSS, though impact is limited to information disclosure.

What it is

The DukaPress plugin for WordPress before 2.5.4 passes the src parameter of lib/dp_image.php into dp_img_resize in php/dp-functions.php without sanitising path sequences, allowing directory traversal. An unauthenticated remote attacker can read files outside the intended image directory. The flaw is a classic CWE-22 path traversal in a widely deployed plugin.

Impact

An attacker can read arbitrary files on the web server that are readable by the web process, including wp-config.php and other configuration or credential files. This is information disclosure only; there is no write, code execution or denial of service in the record.

Attack surface

Reachable over the network through lib/dp_image.php with a crafted src parameter containing ../ sequences. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

CISA KEV does not list this CVE, but two references are tagged Exploit (security.szurek.pl and Exploit-DB 35346), and EPSS is 0.67631 at the 99.278th percentile, indicating a high likelihood of exploitation activity. Public exploit code exists.

What to do

• Update the DukaPress plugin to version 2.5.4 or later, which contains the fix in changeset 1024640.
• If the plugin is unused, deactivate and remove it entirely.
• Restrict file permissions so the web process cannot read sensitive files such as wp-config.php.
• Deploy a WAF rule blocking ../ and encoded traversal sequences in the src parameter to lib/dp_image.php.
• Monitor plugin inventory to confirm no outdated DukaPress instances remain.

Detection

• Search web logs for requests to lib/dp_image.php containing ../ or encoded traversal sequences in the src parameter.
• Alert on HTTP 200 responses to dp_image.php requests that reference files outside the plugin or uploads directory.
• Review file access logs for reads of wp-config.php or other sensitive files by the web server user.
• Scan installed WordPress plugins for DukaPress versions below 2.5.4.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.