PT-2025-6454 · WordPress · The Global Gallery

Lucio Sá · Published 2025-02-12 · Updated 2025-02-12 · CVE-2024-13814

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Global Gallery - WordPress Responsive Gallery plugin for WordPress versions up to, and including, 9.1.5

Description The issue arises from the software allowing users to execute an action that does not properly validate a value before running do shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.

Recommendations For versions up to, and including, 9.1.5, update to a version higher than 9.1.5 to resolve the issue. As a temporary workaround, consider restricting access to the do shortcode function until a patch is available. Additionally, limit Subscriber-level access and above to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-13814

Affected Products

The Global Gallery

References · 8

• https://osv.dev/vulnerability/CVE-2024-13814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13814 · Security Note
• https://codecanyon.net/item/global-gallery-wordpress-responsive-gallery/3310108 · Note
• https://lcweb.it/global-gallery-wordpress-photogallery-plugin/changelog · Note
• https://t.me/cvenotify/111013 · Telegram Post
• https://t.me/cvedetector/17851 · Telegram Post
• https://twitter.com/CVEnew/status/1889673501121913300 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4b5ba815-ce92-4d7b-aa80-29d6fddd7f63?source=cve · Note