CVE-2023-0441 - Gallery Blocks with Lightbox < 3.0.8 - Subscriber+ Arbitrary Options Update

Back Back to CVE browser

HIGH

Gallery Blocks with Lightbox < 3.0.8 - Subscriber+ Arbitrary Options Update

Published Mar 27, 2023

8.1

HIGH

CVSS 3.1

EPSS 0.73%

Description

The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user role.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12495
Advisory
https://wpscan.com/vulnerability/11703e49-c042-4eb6-9a5f-6e006e3725a0
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12495		Advisory
https://wpscan.com/vulnerability/11703e49-c042-4eb6-9a5f-6e006e3725a0		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Mar 27, 2023

Updated Feb 19, 2025

Reserved Jan 23, 2023

Link CVE-2023-0441

CISA Vulnrichment

Updated Feb 19, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-0441

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Mar 27, 2023

Updated Feb 19, 2025

Link EUVD-2023-12495

GitHub

No data