CVE-2024-33586 WordPress Photo Gallery by 10Web plugin <= 1.8.20 - Broken Access Control vulnerability

What is CVE-2024-33586?

CVE-2024-33586 is a medium-severity missing authorization vulnerability in Photo Gallery by 10Web, published on 29 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.20.

Weakness: CWE-862

Which versions are affected by CVE-2024-33586?

It affects 1 product.

Products include 10web Photo Gallery.

How do I fix CVE-2024-33586?

No fix has been published for CVE-2024-33586 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-33586 being exploited?

There is no known exploitation of CVE-2024-33586 in the wild and no public exploit code.

Other vulnerabilities in Photo Gallery by 10Web

• CVE-2022-1281 Photo Gallery < 1.6.3 - Unauthenticated SQL Injection Critical 9.8
• CVE-2022-0169 Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection Critical 9.8
• CVE-2021-24139 Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection Critical 9.8
• CVE-2019-16119 SQL injection in n/a Critical 9.8
• CVE-2019-14313 SQL injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q3mj-8r6m-xx6h.