Filter Portfolio Gallery <= 1.5 - Arbitrary Gallery Deletion via CSRF
CVE-2021-24795

6.5MEDIUM

Key Information:

Vendor

Wordpress
Status
Filter Portfolio Gallery
Vendor
CVE Published:
13 December 2021

What is CVE-2021-24795?

The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery.

Affected Version(s)

Filter Portfolio Gallery 1.5

References

https://wpscan.com/vulnerability/ef3c1d4f-53a4-439e-9434-...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vishal Mohan
.