Photo Gallery by 10Web <= 1.8.46 - Cross-Site Request Forgery to Arbitrary File Overwrite via Image Editor
- ID
- WPSEC-2026-0249
- Plugin
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery (photo-gallery)
- Affected
- all versions before 1.8.47
- Remediation
- Update to 1.8.47 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
- Weakness
- CWE-352
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Photo Gallery by 10Web on WPSec AttackSurface
- Fix released
- Published
Description
The Photo Gallery by 10Web plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.46 due to missing nonce validation on the 'editimage_bwg' AJAX action. The image editor takes the source and destination file paths of its crop and rotate operations from request parameters without confining them to the gallery directory. This makes it possible for unauthenticated attackers to crop, rotate or flip gallery images, or to overwrite arbitrary files writable by the web server with image data (which can take the site offline), via a forged request, granted they can trick a logged-in administrator or other user with gallery management permissions into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-0249/
- https://plugins.svn.wordpress.org/photo-gallery/tags/1.8.47/
- https://wordpress.org/plugins/photo-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS