CVE-2022-38135 MEDIUM

CVE-2022-38135: WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability

Vendor Dean Oakley
Product Photospace Gallery (WordPress plugin)
Weakness CWE-264
Published September 12, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings.

Explanation of Vulnerability in Simple Terms

02Summary

The Photospace Gallery WordPress plugin through version 2.3.5 contains a flaw that allows authenticated users to modify site data or disrupt service. An attacker with low-level access can alter gallery content or cause the plugin to malfunction. This affects sites where user registration is enabled or where multiple user accounts exist.

What an attacker can do

03Attacker Capabilities

Modify gallery data or cause the plugin to stop functioning properly.

Potential impact on your site

04Site Impact

Galleries may be altered or unavailable; site stability may be affected if multiple users have accounts.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress user account (subscriber or above).

Key dates

06Disclosure timeline

September 12, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2022-45369 WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability CVE-2022-38070 WordPress Pop-up plugin <= 1.1.5 - Privilege Escalation vulnerability CVE-2022-38134 WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerability CVE-2022-38461 WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability CVE-2022-35242 WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerability