CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress.This issue affects Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress: from n/a through 21.2.8.4.
Explanation of Vulnerability in Simple Terms
The Photos and Files Contest Gallery plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in site administrator. An attacker can trick an admin into visiting a malicious webpage, which then executes unwanted changes to the plugin's settings or data. No authentication is required from the attacker's side, but the victim must visit the attacker's page while logged into WordPress.
What an attacker can do
Trick a logged-in admin into performing unwanted actions like changing plugin settings or deleting contest data.
Potential impact on your site
An attacker can modify contest settings, delete entries, or alter plugin configuration without your knowledge or consent.
Conditions required to exploit
Admin must visit attacker-controlled webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
