CVE-2024-13814
Published: 12 February 2025
Description
The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 9.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Security Summary
CVE-2024-13814 is an arbitrary shortcode execution vulnerability in The Global Gallery - WordPress Responsive Gallery plugin for WordPress, affecting all versions up to and including 9.1.5. The issue stems from the plugin allowing execution of an action that fails to properly validate a value prior to invoking the do_shortcode function, enabling code injection as classified under CWE-94.
Authenticated attackers possessing Subscriber-level access or higher can exploit this vulnerability remotely with low attack complexity and no user interaction required. Exploitation permits execution of arbitrary shortcodes, potentially compromising low levels of confidentiality and integrity, as reflected in the CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Advisories and patch information are detailed in the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/4b5ba815-ce92-4d7b-aa80-29d6fddd7f63?source=cve, the plugin changelog at https://lcweb.it/global-gallery-wordpress-photogallery-plugin/changelog/, and the plugin's CodeCanyon page at https://codecanyon.net/item/global-gallery-wordpress-responsive-gallery/3310108.
Details
- CWE(s)