CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery allows Cross Site Request Forgery.This issue affects WordPress Gallery Plugin – NextGEN Gallery: from n/a through 3.37.
Explanation of Vulnerability in Simple Terms
NextGEN Gallery versions up to 3.37 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators. An attacker can craft a malicious link or page that, when visited by an admin, triggers unwanted changes to gallery settings or content. The vulnerability requires no special privileges but does require the admin to click a link or visit a page controlled by the attacker.
What an attacker can do
Perform unauthorized actions on the gallery (modify settings, delete content) when an admin visits a malicious link.
Potential impact on your site
Gallery settings or content could be altered without your knowledge if you click a malicious link while logged in.
Conditions required to exploit
Admin must visit a malicious link or page; no special authentication or privileges needed from attacker.
Key dates
External resources
Related vulnerabilities
