PT-2025-10408 · WordPress · Foogallery

Stiofan + 1 · Published 2025-03-08 · Updated 2025-03-12 · CVE-2024-12114

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions FooGallery – Responsive Photo Gallery plugin versions prior to 2.4.30

Description The issue allows authenticated attackers with granted access and above to update arbitrary post and page content due to missing validation on a user-controlled key (img id) in the foogallery attachment modal save AJAX action. This requires the Gallery Creator Role setting to be a value lower than 'Editor' for there to be any real impact.

Recommendations For versions prior to 2.4.30, update to version 2.4.30 or later to resolve the issue. As a temporary workaround, consider setting the Gallery Creator Role to 'Editor' or higher to minimize the risk of exploitation. Restrict access to the foogallery attachment modal save AJAX action to prevent unauthorized updates to post and page content.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-12114

Affected Products

Foogallery

References · 10

• https://osv.dev/vulnerability/CVE-2024-12114 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3250684/foogallery/tags/2.4.30/includes/admin/class-gallery-attachment-modal.php?old=3229839&old_path=foogallery%2Ftags%2F2.4.29%2Fincludes%2Fadmin%2Fclass-gallery-attachment-modal.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-12114 · Security Note
• https://github.com/fooplugins/foogallery/blob/master/includes/admin/class-gallery-attachment-modal.php#L242 · Note
• https://t.me/cvenotify/113974 · Telegram Post
• https://t.me/cvedetector/19887 · Telegram Post
• https://t.me/cvenotify/114483 · Telegram Post
• https://t.me/cvetracker/18728 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f4fe3ad9-247f-4e5d-8c79-0970afaa7729?source=cve · Note
• https://twitter.com/CVEnew/status/1898246326560633088 · Twitter Post