Arbitrary Shortcode Execution Vulnerability in Global Gallery Plugin for WordPress

CVE-2024-13814

What is CVE-2024-13814?

The Global Gallery plugin for WordPress is susceptible to a vulnerability that permits arbitrary shortcode execution across all versions up to and including 9.1.5. This flaw arises from insufficient validation of input values before processing them with the do_shortcode function. Consequently, authenticated users possessing Subscriber-level access or higher can exploit this vulnerability to execute arbitrary shortcodes, potentially leading to unauthorized actions or compromises within the WordPress environment.

References