CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX like wpeg_settings and wpeg_add_gallery in all versions up to, and including, 4.8.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify galleries.
Explanation of Vulnerability in Simple Terms
The WP Easy Gallery plugin for WordPress does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify gallery data they should not have access to. This affects all versions up to 4.8.5. Site owners should update the plugin immediately to prevent unauthorized changes to gallery content.
What an attacker can do
A low-privilege user can modify gallery data without proper authorization checks.
Potential impact on your site
Unauthorized users can alter or corrupt gallery content, potentially affecting site appearance and user experience.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
