WordPress Image Gallery Plugin Missing Authorization Vulnerability Allows Arbitrary Gallery Modification
Vulnerability
A vulnerability exists in the Image Gallery – Photo Grid & Video Gallery plugin for WordPress, in all versions through 2.13.3. The issue arises from a missing capability check in the 'add_images_to_gallery_callback()' function, which allows authenticated attackers with Author-level access and above to add images to any Modula galleries belonging to other users.
Impact
Exploitation of this vulnerability could lead to unauthorized modification of gallery content, allowing attackers to manipulate image collections inappropriately.
Remediation
Users are advised to update the plugin to version 2.13.4 or a newer patched version.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.