WordPress Plugin Vulnerabilities
Gallery Metabox <= 1.5 - Subscriber+ Unauthorized Data Access
Description
The plugin does not correctly implement capability checks on the refresh_metabox function, leading to unauthorized access of data. As a result, subscribers can obtain a list of images attached to a post.
Affects Plugins
No known fix References
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Marco Wotschka
Verified
No
WPVDB ID
Timeline
Publicly Published
2023-06-22 (about 2 years ago)
Added
2023-07-12 (about 2 years ago)
Last Updated
2023-07-12 (about 2 years ago)
WPScan 