PT-2025-7723 · Unknown · Photo Gallery

Mika · Published 2025-02-24 · Updated 2025-03-01 · CVE-2025-27276

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Photo Gallery ( Responsive ) versions prior to 4.0

Description A Cross-Site Request Forgery (CSRF) issue allows Privilege Escalation. This issue enables an attacker to perform actions on behalf of another user without their knowledge or consent.

Recommendations For versions prior to 4.0, update to version 4.0 or later to resolve the issue.

Fix

LPE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-27276

Affected Products

Photo Gallery

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-27276 · Security Note
• https://patchstack.com/database/wordpress/plugin/photo-gallery-pearlbells/vulnerability/wordpress-photo-gallery-responsive-plugin-4-0-csrf-to-privilege-escalation-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/1895791274902634612 · Twitter Post
• https://twitter.com/cracbot/status/1895428870746386885 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/photo-gallery-pearlbells/vulnerability/wordpress-photo-gallery-responsive-plugin-4-0-csrf-to-privilege-escalation-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1894043653238120543 · Twitter Post
• https://twitter.com/CveFindCom/status/1894040632135487657 · Twitter Post