Platform
wordpress
Component
photo-gallery
Fixed in
1.8.20
CVE-2024-0221 is a critical directory traversal vulnerability discovered in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress. This flaw allows authenticated attackers to rename arbitrary files on the server, posing a significant risk of site takeover. The vulnerability impacts versions of the plugin up to and including 1.8.19, and a patch is available from the vendor.
The core impact of CVE-2024-0221 lies in the ability of an authenticated attacker to manipulate files on the WordPress server. Specifically, the rename_item function is vulnerable, allowing an attacker to rename any file they have access to. The most severe consequence is the potential for site takeover if the attacker can rename the wp-config.php file, effectively gaining control of the WordPress installation. While by default this is limited to administrators, the premium version allows granting gallery management permissions to lower-level users, significantly expanding the attack surface. This vulnerability shares similarities with other file manipulation vulnerabilities where unauthorized access to configuration files can lead to complete system compromise.
CVE-2024-0221 was publicly disclosed on February 5, 2024. The vulnerability is considered high probability due to its ease of exploitation and the potential for significant impact. Public proof-of-concept exploits are likely to emerge, increasing the risk of widespread exploitation. Monitor security advisories and threat intelligence feeds for any indications of active exploitation campaigns targeting this vulnerability.
Exploit Status
EPSS
1.16% (79% percentile)
CVSS Vector
The primary mitigation for CVE-2024-0221 is to immediately upgrade the Photo Gallery by 10Web plugin to a version patched against this vulnerability. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider restricting file permissions on the WordPress server to limit the attacker's ability to rename critical files. Implement a Web Application Firewall (WAF) with rules to block attempts to access or manipulate files outside of designated directories. Review user permissions within the plugin, particularly in premium versions, to ensure that only trusted users have gallery management privileges. After upgrade, confirm the fix by attempting to rename a test file outside the intended gallery directory and verifying that the operation is denied.
Update the Photo Gallery by 10Web plugin to the latest version. The Directory Traversal vulnerability has been fixed in versions later than 1.8.19. This will prevent authenticated users from renaming arbitrary files on the server.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-0221 is a critical vulnerability allowing authenticated attackers to rename files on a WordPress server via the Photo Gallery by 10Web plugin, potentially leading to site takeover.
You are affected if your WordPress site uses Photo Gallery by 10Web plugin version 1.8.19 or earlier.
Upgrade the Photo Gallery by 10Web plugin to the latest available version. If immediate upgrade isn't possible, restrict file permissions and consider WAF rules.
While active exploitation hasn't been confirmed, the vulnerability is considered high probability and public exploits are likely to emerge.
Check the 10Web website and WordPress plugin repository for the official advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.