PT-2024-15135 · WordPress · Foogallery

Colin Xu · Published 2024-12-10 · Updated 2025-02-24 · CVE-2023-6947

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FooGallery plugin for WordPress versions up to, and including, 2.4.26

Description The FooGallery plugin for WordPress has a Directory Traversal issue. This allows authenticated attackers with contributor level or higher to read the contents of arbitrary folders on the server, potentially accessing sensitive information such as folder structure.

Recommendations For versions up to, and including, 2.4.26, update to a version higher than 2.4.26 to resolve the issue. As a temporary workaround, consider restricting access to sensitive folders on the server until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-25

CWE-22

Related Identifiers

CVE-2023-6947

Affected Products

Foogallery

References · 9

• https://github.com/fooplugins/foogallery/pull/263/commits/9989f6f4f4d478ec04cb634d09b18c87a5b31c4d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-6947 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6947 · Vendor Advisory
• https://twitter.com/CVEnew/status/1866432910506459593 · Twitter Post
• https://t.me/cvedetector/12483 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1866402467102982574 · Twitter Post
• https://t.me/cvenotify/112323 · Telegram Post
• https://t.me/cvenotify/103691 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/68420c5a-4add-4597-bd2a-20dc831e81bd?source=cve · Note