Unauthorized Access to Private Post Titles in Rbs Image GalleryPlugin

CVE-2024-8431

Summary

The Rbs Image Gallery plugin for WordPress features a security flaw that enables unauthorized data access due to a lack of necessary capability checks within the ajaxGetGalleryJson() function. This vulnerability impacts all versions up to and including 3.2.21, allowing authenticated users with subscriber-level access or higher to exploit the weakness and retrieve private post titles, compromising data confidentiality and user privacy.

References