PT-2025-7338 · WordPress · The Wordpress Portfolio Builder – Portfolio Gallery
Khayal Farzaliyev
+1
·
Published
2025-02-19
·
Updated
2025-02-19
·
CVE-2024-13231
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress versions up to, and including, 1.1.7
Description
The issue is related to unauthorized modification of data due to a missing capability check on the
add video function. This allows unauthenticated attackers to add arbitrary videos to any portfolio gallery.Recommendations
For versions up to, and including, 1.1.7, update to a version higher than 1.1.7 to resolve the issue. As a temporary workaround, consider disabling the
add video function until a patch is available. Restrict access to portfolio galleries to minimize the risk of exploitation. Avoid using the add video function in affected portfolios until the issue is resolved.Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
The Wordpress Portfolio Builder – Portfolio Gallery