CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: from n/a through 1.5.3.
Explanation of Vulnerability in Simple Terms
The Video Gallery plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to access sensitive gallery data they should not be able to view. An attacker with a basic user account can read information from galleries without proper permission checks. This affects versions up to 1.5.3. Update to a version newer than 1.5.3 to resolve the issue.
What an attacker can do
Read gallery data and metadata they do not have permission to access.
Potential impact on your site
Unauthorized users can view private or restricted gallery content, potentially exposing sensitive images or metadata.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
