Unauthorized Access to Modify Galleries via AJAX

CVE-2024-8437

What is CVE-2024-8437?

The WP Easy Gallery plugin for WordPress is susceptible to unauthorized access as it lacks proper capability checks for several AJAX-hooked functions such as wpeg_settings and wpeg_add_gallery. This vulnerability impacts all versions up to and including 4.8.5. Authenticated attackers with subscriber-level access or higher can exploit this flaw to modify galleries, potentially compromising the integrity and security of WordPress sites utilizing the plugin. Website admins are advised to promptly update to secure versions and review system permissions to mitigate potential threats.

References