Unauthorized Modification and Data Loss Vulnerability in ImagePress Image Gallery Plugin

CVE-2024-9824

Summary

The ImagePress – Image Gallery plugin for WordPress has a security flaw that enables authenticated users with Subscriber-level access and above to modify and delete content. This vulnerability arises from a lack of capability checks in the 'ip_delete_post' and 'ip_update_post_title' functions, making it feasible for attackers to execute unauthorized actions on posts. Users should immediately check and update their plugins to mitigate potential risks associated with this vulnerability.

References