Cross-Site Request Forgery Vulnerability in Nilesh Shiragave WordPress Gallery Plugin
CVE-2025-23842

7.1HIGH

Key Information:

Vendor
Wordpress
Status
WordPress Gallery Plugin
Vendor
CVE Published:
16 January 2025

Summary

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WordPress Gallery Plugin by Nilesh Shiragave. This flaw could allow an attacker to trick users into executing unwanted actions on a web application where they are authenticated, potentially leading to unauthorized content manipulation or data exposure. The affected versions range from an unspecified release before version 1.4, necessitating immediate attention to mitigate any security risks associated with this vulnerability.

Affected Version(s)

WordPress Gallery Plugin <= 1.4

References

https://patchstack.com/database/wordpress/plugin/wordpres...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SOPROBRO (Patchstack Alliance)
.