High severity · published Feb 5, 2024
CVE-2024-0221
Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename
7.2
CVSS
1.3%
EPSS
No
On KEV
Description
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the rename_item function. This makes it possible for authenticated attackers to rename arbitrary files on the server. This can lead to site takeovers if the wp-config.php file of a site can be renamed. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery management permissions to lower level users, which might make this exploitable by users as low as contributors.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PG
Photo Gallery by 10Web – Mobile-Friendly Image Gallery · 10web
through 1.8.19 · source: vendor
PG
Photo Gallery · 10web
before 1.8.20 · source: NVD, CISA
Affected product
PG
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
10web
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0221
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0221
Issue Tracking
https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/filemanager/controller.php#L291
Issue Tracking
https://plugins.trac.wordpress.org/browser/photo-gallery/trunk/filemanager/controller.php#L441
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3022981%40photo-gallery%2Ftrunk&old=3013021%40photo-gallery%2Ftrunk&sfp_email=&sfph_mail=
Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/3a3b8f32-f29d-4e67-8fad-202bfc8a9918?source=cve
More from Photo Gallery by 10Web – Mobile-Friendly Image Gallery
8.8
CVE-2024-5481
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function
6.5
CVE-2026-85652
Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute
6.5
CVE-2026-9829
Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter
6.5
CVE-2026-7048
Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
6.4
CVE-2026-86311
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes