Album Gallery WordPress Plugin PHP Object Injection Vulnerability

A PHP Object Injection vulnerability has been identified in the Album Gallery WordPress Gallery plugin, affecting all versions through 1.6.3. The issue arises from the deserialization of untrusted data in the gallery meta, allowing authenticated attackers with Editor-level access or higher to inject PHP objects. While the vulnerable plugin itself does not have a known Payload Object Injection chain, the vulnerability could be exploited if another plugin or theme with such a chain is present, potentially leading to unauthorized file deletion, sensitive data exposure, or arbitrary code execution.

Impact

Exploitation of this vulnerability could allow for PHP Object Injection, with the actual impact depending on the presence of a Payload Object Injection chain through an additional plugin or theme.

Reproduction

To reproduce this vulnerability, an authenticated user with Editor-level access or higher can inject a PHP object by exploiting the deserialization of untrusted input from the gallery meta. This can be done by manipulating the gallery meta data to include serialized PHP objects, which the plugin will then unserialize and process, leading to the injection.

Remediation

Users are advised to update the Album Gallery WordPress Gallery plugin to version 1.6.4 or later.