CVE-2024-3632

Smart Image Gallery < 1.0.19 - Update/Delete Google API Key via CSRF

CVSS 6.8 MEDIUMEPSS 0.3%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.8EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

13 Jul 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected products

Unknown · Smart Image Gallery

References

https://wpscan.com/vulnerability/9b11682d-4705-4595-943f-0fa093d0b644/