CVE-2026-1557

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Feb 26, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-155707.1An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV rCVE-2026-155717.3A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access managemeCVE-2026-155728.8A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, whiCVE-2026-155738.1A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcheCVE-2026-155747.5A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and fullCVE-2026-155755.3Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects CoCVE-2026-155766.9Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client cerCVE-2026-155776.5A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its sCVE-2026-155798.8An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length durCVE-2026-15585.3The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.CVE-2026-155806.9vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PCVE-2026-155818.0A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication
CVE-2026-1557: High severity, CVSS 7.5 | Vulnix