CVE-2025-23842

CVE-2025-23842 is a Cross-Site Request Forgery (CSRF) vulnerability, corresponding to CWE-352, in the Nilesh Shiragave WordPress Gallery Plugin (wordpress-gallery-plugin). The issue affects the plugin from unknown initial versions through version 1.4 inclusive. It was published on 2025-01-16 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low complexity, no required privileges, user interaction, and changed scope with low impacts to confidentiality, integrity, and availability.

Unauthenticated attackers can exploit this CSRF vulnerability by tricking authenticated users into performing unintended actions via malicious requests, such as those forged through external sites. Exploitation requires user interaction, like clicking a link or loading a page, but can occur over the network with low effort. Successful attacks may alter plugin state, potentially leading to impacts like low-level data modification or exposure, amplified by the changed scope.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wordpress-gallery-plugin/vulnerability/wordpress-wordpress-gallery-plugin-plugin-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve) describes this as a CSRF-to-stored XSS vulnerability in version 1.4, providing details for practitioners to review for mitigation strategies, such as updating the plugin beyond version 1.4 or implementing CSRF protections.