CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
What the vulnerability does
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, which can contain sensitive information such as folder structure.
Explanation of Vulnerability in Simple Terms
FooGallery Premium versions up to 2.4.26 contain an authorization flaw that allows authenticated users with low privileges to read sensitive data from other parts of the site. The vulnerability requires a valid user account but no special interaction. The scope is changed, meaning the impact extends beyond the gallery component itself.
What an attacker can do
Read sensitive data from other areas of the site that should be restricted.
Potential impact on your site
Any registered user can access confidential information they shouldn't see, including data outside the gallery.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
