CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Gallery by FooGallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax_get_gallery_info() function in all versions up to, and including, 3.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve metadata (name, image count, thumbnail URL) of private, draft, and password-protected galleries by enumerating gallery IDs.
Explanation of Vulnerability in Simple Terms
Gallery by FooGallery versions 3.1.9 and earlier lack proper authorization checks, allowing authenticated users to access gallery data they should not be able to view. An attacker with a low-privilege account can read sensitive information from galleries belonging to other users or restricted content. This affects all installations where multiple users have access to the plugin.
What an attacker can do
Read gallery data and sensitive information from galleries they don't own or have permission to access.
Potential impact on your site
User data and gallery content may be exposed to unauthorized site users with low-privilege accounts.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no special interaction required.
Key dates
External resources
