Perfect Images - Information Disclosure (CVE-2023-44982)

CVE-2023-44982 is an information disclosure vulnerability in the Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina) plugin by Jordy Meow, affecting versions up to 6.4.5. This flaw allows unauthorized actors to access sensitive information, potentially exposing confidential data to attackers without authentication.

CrowdSec has been tracking this vulnerability and its exploits since 15th of April 2026.

CrowdSec network observations suggest that most exploitation of CVE-2023-44982 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2023-44982. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit this vulnerability by directly requesting log files such as /wp-content/plugins/wp-retina-2x/classes/wp-retina-2x.log, /wp-content/uploads/wp-retina-2x.log, or /wp-content/uploads/wp-retina-2x-logs.txt to access sensitive information exposed by the WP Retina 2x plugin.