Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) in the Photo Gallery by Ays plugin for WordPress, affecting all versions up to and including 6.4.8. It occurs because the plugin's bulk action functionality lacks nonce verification in the 'process_bulk_action()' function. This allows an attacker to trick an administrator into performing bulk operations such as deleting, publishing, or unpublishing galleries via a forged request without proper authentication.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this vulnerability to perform unauthorized bulk actions on galleries, such as deleting, publishing, or unpublishing them, by tricking an administrator into clicking a malicious link. This can lead to unintended content changes or loss of data within the WordPress site.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Photo Gallery by Ays plugin for WordPress to a version later than 6.4.8 where the nonce verification issue in the 'process_bulk_action()' function is fixed. Additionally, avoid clicking on suspicious links that could trigger bulk actions, and ensure that only trusted administrators have access to perform bulk operations.

Useful 0 Not Useful 0