WordPress Gmedia Photo Gallery plugin <= 1.25.0 - Cross Site Request Forgery (CSRF) vulnerability

The CSRF vulnerability allows an attacker to trick a logged-in user into unknowingly performing actions they didn't intend. For example, an attacker could craft a malicious link that, when clicked, modifies gallery settings, deletes images, or performs other administrative actions. The impact is amplified if the attacker can target users with administrative privileges, potentially leading to complete site compromise. This vulnerability is similar to other CSRF attacks, where the attacker leverages the user's authenticated session to execute malicious requests.

WordPress websites utilizing the Gmedia Photo Gallery plugin, particularly those running versions 0.0.0 through 1.25.0, are at risk. Shared hosting environments where plugin updates are managed centrally are also at increased risk due to potential delays in patching.

• wordpress / composer / npm:

grep -r 'gmedia_photo_gallery_settings' wp-content/plugins/gmedia-photo-gallery/

• generic web:

curl -I https://example.com/wp-content/plugins/gmedia-photo-gallery/ | grep -i 'csrf-token'

1. 2025-12-31Disclosure

   disclosure

1. Reserviert2025-10-24
2. Veröffentlicht2025-12-31
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade the Gmedia Photo Gallery plugin to a version that addresses this vulnerability. If immediate upgrading is not possible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) with CSRF protection rules. Additionally, carefully review and restrict user permissions to minimize the potential impact of a successful attack. Implement strict input validation and output encoding practices within the plugin itself to prevent future CSRF vulnerabilities. After upgrade, confirm by reviewing the plugin's changelog and testing core functionality.

Aktive Installationen

8KNische

Plugin-Bewertung