CVE-2021-4384 in Photo Gallery plugin
Summary
by MITRE • 07/01/2023
The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the load_images_thumbnail() and edit_gallery() functions. This makes it possible for unauthenticated attackers to edit galleries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The WordPress Photo Gallery plugin presents a critical cross-site request forgery vulnerability that affects versions through 1.0.6, creating a significant security risk for WordPress installations. This vulnerability stems from inadequate nonce validation mechanisms within the plugin's core functions, specifically the load_images_thumbnail() and edit_gallery() methods that handle gallery modifications. The flaw allows attackers to manipulate gallery content without proper authentication, exploiting the trust relationship between the web application and the administrator's browser. The vulnerability is particularly dangerous because it requires no authentication from the attacker, relying instead on social engineering techniques to deceive administrators into executing malicious actions.
The technical implementation of this vulnerability involves the absence of proper nonce verification in the affected plugin functions, which should have validated cryptographic tokens to ensure requests originated from legitimate administrative sessions. According to CWE-352, this represents a classic cross-site request forgery weakness where the application fails to validate that requests are intentional actions from authenticated users. The plugin's failure to implement proper request validation creates an attack surface where malicious actors can craft forged requests that appear legitimate to the WordPress administration interface. This allows unauthorized modifications to gallery configurations, potentially leading to content manipulation, data exposure, or even complete gallery compromise.
The operational impact of this vulnerability extends beyond simple gallery modifications to potentially compromise entire WordPress installations through cascading effects. Administrators who inadvertently click on malicious links or visit compromised websites could unknowingly execute gallery editing operations, leading to unauthorized content changes that might include malicious redirects, altered image displays, or even the injection of harmful scripts. The vulnerability's exploitation requires minimal technical skill from attackers, as it relies on social engineering rather than complex exploitation techniques, making it particularly dangerous in environments where administrators frequently browse untrusted websites. This weakness can also serve as a foothold for more sophisticated attacks, as compromised galleries may be used to distribute malware or conduct phishing operations.
Mitigation strategies should focus on immediate plugin updates to versions that properly implement nonce validation, as well as implementing additional security measures such as role-based access controls and monitoring for unauthorized gallery modifications. Organizations should consider implementing web application firewalls to detect and block suspicious requests, while also conducting regular security audits of installed plugins to identify similar vulnerabilities. The ATT&CK framework categorizes this vulnerability under T1071.004 Application Layer Protocol: DNS, as attackers may use manipulated gallery content to redirect users to malicious domains. Regular security training for administrators about recognizing phishing attempts and suspicious links can significantly reduce the risk of exploitation, while maintaining up-to-date WordPress core installations and plugins helps prevent similar vulnerabilities from being exploited across the entire web application stack.