CVE-2015-1784 WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Cross-Site Request Forgery
HighCVSS 8.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress nextgen-gallery(WordPress) | < 2.0.77.3 | 2.0.77.3 |
| imagely nextgen gallery | < 2.0.77.3 | 2.0.77.3 |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- blog.nettitude.com exploit third-party-advisory
- wpscan.com third-party-advisory