Gallery PhotoBlocks, 49a2c22c842d21090919f915e007d58f37281c95

CVE, Research URL: 49a2c22c842d21090919f915e007d58f37281c95
Home page URL: Security reports for Gallery PhotoBlocks
Application: Gallery PhotoBlocks
Published on: Aug 17, 2022
Research Description: Gallery PhotoBlocks [photoblocks-grid-gallery] < 1.2.9 Gallery PhotoBlocks <= 1.2.8 - Missing Authorization Checks The Gallery PhotoBlocks plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.2.8 due to missing capability checks on the init() function found in the ~/admin/class-photoblocks-admin.php file. This makes it possible for authenticated users with minimal permissions, such as a subscriber, to delete and clone gallery photoblocks.
Affected versions: max 1.2.9.
Status: vulnerable