CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery allows Code Injection.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through <= 1.5.7.
Explanation of Vulnerability in Simple Terms
The Limb Image Gallery WordPress plugin versions 1.5.7 and earlier allow authenticated users to upload files without proper validation. An attacker with low-level site access can upload malicious files, including PHP code, to execute arbitrary commands on the server. This affects all site data and functionality.
What an attacker can do
Upload and execute malicious files (including PHP code) on the server to take full control of the site.
Potential impact on your site
Complete site compromise: attacker can read/modify all data, create admin accounts, inject malware, or take the site offline.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., contributor or subscriber role).
Key dates
External resources
Related vulnerabilities
