WordPress Plugin Vulnerabilities

Album Gallery – WordPress Gallery < 1.5.0 - Cross-Site Request Forgery

Description

The plugin does not have CSRF checks (either flawed or missing completely) in when performing update actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.

Affects Plugins

Plugin icon
new-album-gallery
Fixed in 1.5.0

References

CVE
CVE-2023-23646
URL
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/new-album-gallery/album-gallery-wordpress-gallery-149-cross-site-request-forgery-via-album-gallery-column-settingsphp

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Verified
Yes
WPVDB ID
7d92146b-f799-4cf8-bd9b-e9489e9c3cbf

Timeline

Publicly Published
2023-07-17 (about 2 years ago)
Added
2023-07-17 (about 2 years ago)
Last Updated
2023-07-17 (about 2 years ago)

Other

Published
Title
Published
2024-07-04
Title
Posterity < 3.4 - Cross-Site Request Forgery to Notice Dismissal
Published
2024-05-07
Title
Squelch Tabs and Accordions Shortcodes < 0.4.8 - Cross-Site Request Forgery
Published
2023-11-14
Title
Big File Uploads < 2.1.2 - Cross-Site Request Forgery via actions
Published
2025-08-25
Title
Newsletter subscription optin module <= 1.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2022-04-14
Title
Fancy Product Designer < 4.7.6 - Arbitrary File Upload via CSRF