PHP Object Injection Vulnerability in WordPress Photo Gallery Plugin by Photo Gallery Vendor

CVE-2024-1896

Summary

The Photo Gallery – Responsive Photo Gallery plugin for WordPress is susceptible to a PHP Object Injection flaw through untrusted input deserialization via the 'awl_lg_settings_' shortcode attribute. This vulnerability exists in all versions up to and including 1.4.1, allowing authenticated attackers with contributor privileges or higher to potentially inject PHP objects. While there is no inherent PHP Object Pollution (POP) chain within the plugin itself, if a POP chain exists via other plugins or themes on the affected WordPress installation, it can lead to grave risks including arbitrary file deletions, access to sensitive data, or unauthorized code execution.

References