PT-2025-7338 · WordPress · The Wordpress Portfolio Builder – Portfolio Gallery

Khayal Farzaliyev

+1

·

Published

2025-02-19

·

Updated

2025-02-19

·

CVE-2024-13231

CVSS v3.1
5.3
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress versions up to, and including, 1.1.7
Description The issue is related to unauthorized modification of data due to a missing capability check on the 
add video
function. This allows unauthenticated attackers to add arbitrary videos to any portfolio gallery.
Recommendations For versions up to, and including, 1.1.7, update to a version higher than 1.1.7 to resolve the issue. As a temporary workaround, consider disabling the 
add video
function until a patch is available. Restrict access to portfolio galleries to minimize the risk of exploitation. Avoid using the 
add video
function in affected portfolios until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-13231

Affected Products

The Wordpress Portfolio Builder – Portfolio Gallery