Filter Gallery
Monthly
An authorization bypass in the Filter Gallery WordPress plugin (farazfrank:filter_gallery) affects all versions up to and including 1.1.4, allowing any authenticated user with subscriber-level access or above to delete arbitrary gallery records - including their filters, image mappings, settings, and details options - by supplying attacker-controlled gallery IDs. The delete handler never verifies ownership or capabilities, and the accompanying nonce check can be evaded simply by omitting the nonce POST field entirely, although a present-but-invalid nonce is correctly rejected. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (8.1), and no public exploit code and no confirmed active exploitation were identified at time of analysis; sites that permit open user self-registration are the most exposed, so vendor CVSS 8.1 is well supported by the description.
Authenticated low-privileged WordPress users can overwrite the content of arbitrary posts and wipe the Filter Gallery plugin's stored gallery options on sites running Filter Gallery versions 1.1.2 through before 1.1.5. The plugin's AJAX handlers skip nonce verification when the nonce field is omitted and perform no capability check, so any logged-in account - including subscribers - can invoke privileged actions over the network without user interaction. Publicly available exploit code exists and the WPScan entry documents the attack path, though there is no confirmation of active exploitation (CISA KEV); EPSS data was not provided. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 7.1) and our independent assessment agree on high integrity impact and low availability impact with no confidentiality loss.
Authorization bypass in the Filter Gallery plugin for WordPress (versions up to and including 1.1.4) lets any authenticated user with subscriber-level access or higher rewrite the title and content of arbitrary posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options. The flaw is a missing capability/nonce check in the plugin's AJAX-style handlers (CWE-862), so no user interaction and no non-default configuration are required beyond the plugin being installed and active; the practical prerequisite is a low-privilege account, which is trivial on sites with open registration but a real barrier where self-registration is disabled. Impact is integrity-only - no confidentiality or availability loss and no code execution - and no public exploit code has been identified at time of analysis.
An authorization bypass in the Filter Gallery WordPress plugin (farazfrank:filter_gallery) affects all versions up to and including 1.1.4, allowing any authenticated user with subscriber-level access or above to delete arbitrary gallery records - including their filters, image mappings, settings, and details options - by supplying attacker-controlled gallery IDs. The delete handler never verifies ownership or capabilities, and the accompanying nonce check can be evaded simply by omitting the nonce POST field entirely, although a present-but-invalid nonce is correctly rejected. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (8.1), and no public exploit code and no confirmed active exploitation were identified at time of analysis; sites that permit open user self-registration are the most exposed, so vendor CVSS 8.1 is well supported by the description.
Authenticated low-privileged WordPress users can overwrite the content of arbitrary posts and wipe the Filter Gallery plugin's stored gallery options on sites running Filter Gallery versions 1.1.2 through before 1.1.5. The plugin's AJAX handlers skip nonce verification when the nonce field is omitted and perform no capability check, so any logged-in account - including subscribers - can invoke privileged actions over the network without user interaction. Publicly available exploit code exists and the WPScan entry documents the attack path, though there is no confirmation of active exploitation (CISA KEV); EPSS data was not provided. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 7.1) and our independent assessment agree on high integrity impact and low availability impact with no confidentiality loss.
Authorization bypass in the Filter Gallery plugin for WordPress (versions up to and including 1.1.4) lets any authenticated user with subscriber-level access or higher rewrite the title and content of arbitrary posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options. The flaw is a missing capability/nonce check in the plugin's AJAX-style handlers (CWE-862), so no user interaction and no non-default configuration are required beyond the plugin being installed and active; the practical prerequisite is a low-privilege account, which is trivial on sites with open registration but a real barrier where self-registration is disabled. Impact is integrity-only - no confidentiality or availability loss and no code execution - and no public exploit code has been identified at time of analysis.