CVE-2019-14205: WordPress Adaptive Images plugin path traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote file disclosure with a high CVSS score and very high EPSS probability, though not listed in CISA KEV.

What it is

The Nevma Adaptive Images plugin before 0.6.67 for WordPress contains a local file inclusion flaw in adaptive-images-script.php. The source_file parameter under adaptive-images-settings is not properly validated, letting a remote attacker read files outside the intended directory. Because the plugin is commonly installed on public WordPress sites, unauthenticated file disclosure is possible.

Impact

An attacker can retrieve arbitrary files readable by the web server, exposing configuration files, credentials, and other sensitive data. The CVSS vector shows high confidentiality impact with no integrity or availability impact.

Attack surface

Reachable over the network through adaptive-images-script.php with the adaptive-images-settings[source_file] parameter. The CVSS vector indicates no privileges required and no user interaction, so it can be triggered directly by an unauthenticated remote request.

Exploitation

Public exploit references are tagged Exploit and Third Party Advisory, and EPSS is 0.63375 (99.172 percentile), indicating high likelihood of exploitation activity. The CVE is not listed in CISA KEV.

What to do

• Update the Adaptive Images plugin to version 0.6.67 or later.
• If immediate patching is not possible, disable or remove the plugin until it can be updated.
• Restrict access to adaptive-images-script.php at the web server or WAF where feasible.
• Review web server file permissions so the WordPress process cannot read unrelated sensitive files.
• Monitor plugin advisories and WordPress update channels for further guidance.

Detection

• Search web access logs for requests to adaptive-images-script.php containing adaptive-images-settings and source_file parameters.
• Look for source_file values containing path traversal sequences such as ../ or absolute paths.
• Alert on unusual file paths or sensitive filenames requested through the plugin endpoint.
• Correlate repeated or automated requests to the plugin script from single source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.