PT-2025-5220 · Unknown · Ngoccode Wp Load Gallery

Le Ngoc Anh · Published 2025-01-22 · Updated 2025-02-26 · CVE-2025-23942

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NgocCode WP Load Gallery versions 2.1.6 and earlier

Description The issue allows unrestricted upload of files with dangerous types, enabling attackers to upload a web shell to a web server. This can be exploited by uploading malicious files, potentially leading to server compromise. The estimated number of potentially affected devices is not specified.

Recommendations For NgocCode WP Load Gallery versions 2.1.6 and earlier, update to version 2.1.7 to patch this issue. As a temporary workaround, consider restricting file uploads to prevent exploitation until the update can be applied.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-23942

Affected Products

Ngoccode Wp Load Gallery

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-23942 · Security Note
• https://twitter.com/VulmonFeeds/status/1882112961293996276 · Twitter Post
• https://twitter.com/CveFindCom/status/1882081495956758873 · Twitter Post
• https://t.me/cvedetector/16094 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/wp-load-gallery/vulnerability/wordpress-wp-load-gallery-plugin-2-1-6-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/Nxploit1/status/1894538067324633202 · Twitter Post
• https://twitter.com/CVEnew/status/1882137421590233172 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/wp-load-gallery/vulnerability/wordpress-wp-load-gallery-plugin-2-1-6-arbitrary-file-upload-vulnerability?_s_id=cve · Note