CVE-2024-33586

The vulnerability is a broken access control issue in the Photo Gallery by 10Web WordPress plugin for versions prior to 1.8.21. The plugin fails to properly check authorization, authentication, or nonce tokens in certain functions, allowing unprivileged users to execute actions that should require higher privileges [1].

Attackers can exploit this missing authorization by sending crafted requests to the affected plugin's endpoints without any authentication. This vulnerability is commonly used in mass-exploit campaigns, targeting thousands of websites regardless of their size or popularity [1].

Successful exploitation allows an attacker to perform unauthorized actions, such as accessing or modifying protected gallery settings or data, which could compromise the site's integrity. The impact is considered low severity, and exploitation is unlikely, but it poses a risk if left unpatched [1].

The vulnerability has been addressed in version 1.8.21. Users are advised to update to this version or later. Patchstack users can enable auto-updates for vulnerable plugins. If unable to update immediately, consulting a hosting provider or web developer is recommended [1].