Gallery by FooGallery Missing Authorization Vulnerability Allowing Unauthorized Gallery Metadata Access

A vulnerability exists in the Gallery by FooGallery plugin for WordPress, in all versions through 3.1.9. The issue arises from a lack of proper capability checks in the ajax_get_gallery_info() function. This flaw enables authenticated attackers with Subscriber-level access and above to access metadata from private, draft, and password-protected galleries by simply enumerating gallery IDs. The exposed metadata includes the gallery name, image count, and thumbnail URL.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive gallery metadata, including names, image counts, and thumbnail URLs, from private, draft, and password-protected galleries.

Remediation

Users are advised to update the Gallery by FooGallery plugin to version 3.1.10 or a newer patched version.