Vulnerability · Published Jan 3, 2025 · Assigned by Wordfence

CVE-2024-12237Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.15 - Authenticated (Subscriber+) Limited Server-Side Request Forgery

Medium 4.3

In plain English

A medium-severity server-side request forgery in Photo Gallery Slideshow & Masonry Tiled Gallery from nik00726. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 66.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.15 via the rjg_get_youtube_info_justified_gallery_callback function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to retrieve limited information from internal services.

Affected products (as reported)

Vendor	Product	Versions
nik00726	Photo Gallery Slideshow & Masonry Tiled Gallery	0 – through 1.0.15

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References