Photo Gallery Sliders Proofing And Themes
Monthly
Arbitrary file write - escalating to remote code execution on hosts that execute PHP from upload directories - affects the WordPress plugin Photo Gallery, Sliders, Proofing and Themes in all versions before 4.5.0. The flaw sits in the archive-extraction routine: a variable is reused as a loop counter, so the filename-extension check always passes and a user who has been granted the plugin's gallery-management capability by an administrator can place an attacker-controlled file (including a .php payload) into a web-accessible gallery directory; the CVSS vector (PR:H, UI:N) confirms this is an authenticated, elevated-privilege path rather than a subscriber or anonymous one. Publicly available exploit code exists, so exploitation is realistic for any site where a non-administrator holds the gallery-management role, and full code execution depends on the host actually serving PHP out of the upload path - on hardened hosts the impact is limited to arbitrary file write.
Authenticated WordPress users who hold only the gallery-management capability of the plugin Photo Gallery, Sliders, Proofing and Themes can save site-wide image-sizing settings they are not entitled to change, because versions before 4.5.0 omit a capability check before writing those options. Only sites running the plugin at a version below 4.5.0 are affected, and the attacker must already have been granted the delegated gallery-management role by an administrator - this is a privilege-boundary erosion between two internal roles, not an unauthenticated compromise, and the impact is limited to the integrity of image-sizing configuration (no data disclosure, no availability loss). Severity is genuinely low (CVSS 3.1, assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and publicly available exploit code exists; there is no CISA KEV listing and therefore no confirmation of active exploitation in the wild.
Improper authorization in the WordPress plugin Photo Gallery, Sliders, Proofing and Themes before version 4.5.0 lets a user who has been granted the plugin's gallery-management capability delete, copy, and re-tag images that belong to other users' galleries. The flaw is an IDOR-class (CWE-639) authorization bypass that requires an authenticated WordPress account already holding that capability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L per our independent assessment; the published score is 4.2 with a more conservative AC:H vector), so anonymous visitors cannot reach it. Publicly available exploit code exists (WPScan), but there is no confirmed active exploitation (CISA KEV) and vendor-released patched version 4.5.0 is available.
Missing object-level authorization in the Photo Gallery, Sliders, Proofing and Themes WordPress plugin before 4.5.0 allows authenticated users with the Contributor role or higher to read the stored metadata of any image on the site, including images that belong to other users' galleries; publicly available exploit code exists. Exploitation requires an authenticated Contributor+ account on a site running an affected version (3.59.5 through 4.5.0), needs no user interaction or special configuration, and is impossible for anonymous visitors, which caps the practical impact at low confidentiality loss. The disclosed data is limited to the image's stored EXIF subset (camera make and model, capture timestamp) plus internal checksums and identifiers that the plugin's own capability-gated read path normally reserves for administrators, so no image files, credentials, or user PII are exposed and overall priority is minor.
Authenticated users who have been granted the plugin's gallery-management capability can overwrite the stored settings of any gallery on a WordPress site running the 'Photo Gallery, Sliders, Proofing and Themes' plugin before 4.5.0, including galleries belonging to other users and each gallery's stored filesystem path, because the save routine never checks that the submitted gallery ID belongs to the requesting account (CWE-639, IDOR). Impact is integrity-only and rated Low (CVSS 3.1); the flaw is not reported as actively exploited, but publicly available exploit code exists, and the vendor has released 4.5.0 to correct it. Note that the attacker is not an anonymous visitor - the actor must already hold a capability an administrator deliberately delegated, and must know the IDs of galleries they do not own.
Arbitrary file write - escalating to remote code execution on hosts that execute PHP from upload directories - affects the WordPress plugin Photo Gallery, Sliders, Proofing and Themes in all versions before 4.5.0. The flaw sits in the archive-extraction routine: a variable is reused as a loop counter, so the filename-extension check always passes and a user who has been granted the plugin's gallery-management capability by an administrator can place an attacker-controlled file (including a .php payload) into a web-accessible gallery directory; the CVSS vector (PR:H, UI:N) confirms this is an authenticated, elevated-privilege path rather than a subscriber or anonymous one. Publicly available exploit code exists, so exploitation is realistic for any site where a non-administrator holds the gallery-management role, and full code execution depends on the host actually serving PHP out of the upload path - on hardened hosts the impact is limited to arbitrary file write.
Authenticated WordPress users who hold only the gallery-management capability of the plugin Photo Gallery, Sliders, Proofing and Themes can save site-wide image-sizing settings they are not entitled to change, because versions before 4.5.0 omit a capability check before writing those options. Only sites running the plugin at a version below 4.5.0 are affected, and the attacker must already have been granted the delegated gallery-management role by an administrator - this is a privilege-boundary erosion between two internal roles, not an unauthenticated compromise, and the impact is limited to the integrity of image-sizing configuration (no data disclosure, no availability loss). Severity is genuinely low (CVSS 3.1, assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and publicly available exploit code exists; there is no CISA KEV listing and therefore no confirmation of active exploitation in the wild.
Improper authorization in the WordPress plugin Photo Gallery, Sliders, Proofing and Themes before version 4.5.0 lets a user who has been granted the plugin's gallery-management capability delete, copy, and re-tag images that belong to other users' galleries. The flaw is an IDOR-class (CWE-639) authorization bypass that requires an authenticated WordPress account already holding that capability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L per our independent assessment; the published score is 4.2 with a more conservative AC:H vector), so anonymous visitors cannot reach it. Publicly available exploit code exists (WPScan), but there is no confirmed active exploitation (CISA KEV) and vendor-released patched version 4.5.0 is available.
Missing object-level authorization in the Photo Gallery, Sliders, Proofing and Themes WordPress plugin before 4.5.0 allows authenticated users with the Contributor role or higher to read the stored metadata of any image on the site, including images that belong to other users' galleries; publicly available exploit code exists. Exploitation requires an authenticated Contributor+ account on a site running an affected version (3.59.5 through 4.5.0), needs no user interaction or special configuration, and is impossible for anonymous visitors, which caps the practical impact at low confidentiality loss. The disclosed data is limited to the image's stored EXIF subset (camera make and model, capture timestamp) plus internal checksums and identifiers that the plugin's own capability-gated read path normally reserves for administrators, so no image files, credentials, or user PII are exposed and overall priority is minor.
Authenticated users who have been granted the plugin's gallery-management capability can overwrite the stored settings of any gallery on a WordPress site running the 'Photo Gallery, Sliders, Proofing and Themes' plugin before 4.5.0, including galleries belonging to other users and each gallery's stored filesystem path, because the save routine never checks that the submitted gallery ID belongs to the requesting account (CWE-639, IDOR). Impact is integrity-only and rated Low (CVSS 3.1); the flaw is not reported as actively exploited, but publicly available exploit code exists, and the vendor has released 4.5.0 to correct it. Note that the attacker is not an anonymous visitor - the actor must already hold a capability an administrator deliberately delegated, and must know the IDs of galleries they do not own.