CVE-2024-8431: Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Private Gallery Title Disclosure

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-08 · updated 2026-06-17
Weakness: CWE-862

Description

The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve private post titles.

Affected products

robosoft Robo Gallery – Photo & Image Slider: through 3.2.21

References

https://plugins.trac.wordpress.org/browser/robo-gallery/tags/3.2.21/includes/extensions/block/src/init.php#L105
https://plugins.trac.wordpress.org/changeset/3162670/robo-gallery/trunk/includes/extensions/block/src/init.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/632c0a1a-6ac2-44c3-b66c-44fa4cf05b2d?source=cve

Get alerted when CVE-2024-8431 or the next vulnerability affects your stack