CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to view, create, modify, clone, delete, and reassign ownership of galleries created by other users, including administrators.
Explanation of Vulnerability in Simple Terms
Image Photo Gallery Final Tiles Grid through version 3.6.9 fails to properly check user permissions before allowing access to certain gallery operations. A logged-in user with low privileges can read or modify gallery data they should not have access to. Update to a version newer than 3.6.9.
What an attacker can do
Read or modify gallery data without proper authorization.
Potential impact on your site
Unauthorized users can view or alter gallery content, potentially exposing or corrupting image collections.
Conditions required to exploit
Attacker must be logged in as a low-privilege user (e.g., subscriber or contributor).
Key dates
External resources
