Cross-Site Request Forgery Vulnerability in Image Gallery Plugin

CVE-2024-5343

Summary

The Rbs Image Gallery plugin for WordPress is affected by a vulnerability that enables Cross-Site Request Forgery (CSRF) attacks. This vulnerability stems from insufficient or incorrect nonce validation in the 'rbs_ajax_create_article' and 'rbs_ajax_reset_views' functions. Attackers can exploit this weakness to deceive users with Contributor+ privileges into executing unauthorized actions, such as creating new posts or resetting gallery view counts, simply by clicking on malicious links. This poses a significant risk to the integrity of user-generated content and could lead to unwanted changes in the gallery's settings.

References