CVE-2023-0441: Gallery Blocks with Lightbox < 3.0.8 - Subscriber+ Arbitrary Options Update

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-27 · updated 2026-06-17

Description

The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user role.

Affected products

Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native galler: before 3.0.8 — fixed in 3.0.8

How to fix

Upgrade to a fixed version: Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native galler 3.0.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-0441 or the next vulnerability affects your stack