NextGEN Gallery < 3.39 - Admin+ Local File Inclusion
CVE-2023-3279

4.9MEDIUM

Key Information:

Vendor
Wordpress
Status
WordPress Gallery Plugin
Vendor
CVE Published:
16 October 2023

Summary

The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks

Affected Version(s)

WordPress Gallery Plugin 0 < 3.39

References

https://wpscan.com/vulnerability/3b7a7070-8d61-4ff8-b003-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Sanford
WPScan
.