CVE-2024-5853: Sirv

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sirv_upload_file_by_chanks AJAX action in all versions up to, and including, 7.2.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected products

• Sirv Sirv: before 7.2.7 (fixed in 7.2.7)

Published 2024-06-19. Last modified 2026-06-17.