WordPress NextGEN Gallery Plugin <= 3.37 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2023-48328

8.8HIGH

Key Information:

Vendor

Wordpress
Status
WordPress Gallery Plugin – NextGEN Gallery
Vendor
CVE Published:
30 November 2023

What is CVE-2023-48328?

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Imagely WordPress Gallery Plugin – NextGEN Gallery. This vulnerability allows attackers to execute unauthorized actions on behalf of authenticated users without their consent. This issue affects all versions up to 3.37, posing significant risks to website security and integrity. Website administrators are urged to implement protective measures and update to the latest version to mitigate potential threats.

Affected Version(s)

WordPress Gallery Plugin – NextGEN Gallery <= 3.37

References

https://patchstack.com/database/vulnerability/nextgen-gal...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

FearZzZz (Patchstack Alliance)
.