Insecure Direct Object Reference in FooGallery Plugin for WordPress

CVE-2024-12114

What is CVE-2024-12114?

The FooGallery - Responsive Photo Gallery plugin for WordPress has a vulnerability that allows authenticated attackers with access to make unauthorized changes to post and page content. This vulnerability arises from a lack of proper validation on a user-controlled key (img_id) during the processing of the foogallery_attachment_modal_save AJAX action. Notably, for the vulnerability to be exploited, the Gallery Creator Role must be configured with a value lower than 'Editor'. This flaw exposes WordPress sites to potential content manipulation risks if not addressed.

References