Photo Gallery by 10Web Vulnerability – Directory Traversal to Arbitrary File Rename – CVE-2024-0221 | WordPress Plugin Vulnerability Report

Q: What is the vulnerability in Photo Gallery by 10Web?

What is the vulnerability in Photo Gallery by 10Web? The Photo Gallery plugin by 10Web has a path traversal vulnerability that was discovered in versions up to and including 1.8.19. This vulnerability allows authenticated users, like admins, to exploit the rename_item function to rename arbitrary files outside of the intended photo gallery directory on the server. For example, attackers could rename key WordPress files and take over sites.

Q: How severe is this Photo Gallery plugin vulnerability?

How severe is this Photo Gallery plugin vulnerability? This vulnerability is considered critical severity, with a CVSS base score of 9.1 out of 10. The ability of authenticated users to traverse directories and rename sensitive files enables serious impacts like malware injection, data theft, and full site takeovers by renaming wp-config.php in the root directory of the WordPress site. The ease of exploiting this vulnerability contributes to the high severity assessment.

Q: What versions of the Photo Gallery plugin are affected?

What versions of the Photo Gallery plugin are affected? All versions of Photo Gallery by 10Web up to and including 1.8.19 contain this vulnerability and should be updated immediately. The issue is fixed in version 1.8.20, which was released after the vulnerability was reported privately to 10Web by the security researcher Bence Szalai. So upgrading sites to 1.8.20 resolves the vulnerability.

Q: How can I tell if my WordPress site is vulnerable?

How can I tell if my WordPress site is vulnerable? If your WordPress site has the Photo Gallery plugin by 10Web active, you can check which version is installed by going to Plugins > Installed Plugins within your WordPress dashboard. If the version listed is 1.8.19 or below, your site is impacted and should be updated to close this security flaw. You can also use available WordPress vulnerability scanners to automatically detect if your active plugins contain any published vulnerabilities.

By Your WP Guy | January 19, 2024

Plugin Name: Photo Gallery by 10Web

Key Information:

Software Type: Plugin
Software Slug: photo-gallery
Software Status: Active
Software Author: 10web
Software Downloads: 17,512,296
Active Installs: 200,000
Last Updated: January 19, 2024
Patched Versions: 1.8.20
Affected Versions: <= 1.8.19

Vulnerability Details:

Name: Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename
Type: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE: CVE-2024-0221
CVSS Score: 9.1 (Critical)
Publicly Published: January 19, 2024
Researcher: Bence Szalai
Description: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the rename_item function. This makes it possible for authenticated attackers to rename arbitrary files on the server. This can lead to site takeovers if the wp-config.php file of a site can be renamed. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery management permissions to lower level users, which might make this exploitable by users as low as contributors.

Summary:

The Photo Gallery by 10Web plugin for WordPress has a critical vulnerability in versions up to and including 1.8.19 that allows authenticated users to rename arbitrary files on the server via a directory traversal issue in the rename_item function. This has been patched in version 1.8.20.

Detailed Overview:

A vulnerability discovered by researcher Bence Szalai makes it possible for authenticated WordPress users to exploit a directory traversal issue and rename arbitrary files on the server where Photo Gallery by 10Web is installed. By renaming key files like wp-config.php, this could lead to complete site takeover. The vulnerability exists in the rename_item function. By default, only admins can exploit it but in the premium version, admins can assign gallery management permissions to contributors and up, making this exploitable by lower privilege users as well. The vulnerability has been given a CVSS score of 9.1 (Critical severity). Users are advised to update immediately to version 1.8.20 which contains the fix.

Advice for Users:

Immediate Action: Update to version 1.8.20 or higher immediately.
Check for Signs of Vulnerability: Review logs for unexpected activity and scan for malware. Revert any renamed files.
Alternate Plugins: Consider alternate gallery plugins like Envira Gallery as a precaution.
Stay Updated: Always keep plugins updated to avoid vulnerabilities.

Conclusion:

The quick response from 10Web to patch this critical vulnerability shows their commitment to security. Users should ensure they are running version 1.8.20 or higher as soon as possible to prevent compromise.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/photo-gallery

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/photo-gallery/photo-gallery-by-10web-mobile-friendly-image-gallery-1819-directory-traversal-to-arbitrary-file-rename

Detailed Report:

Keeping your website secure should be a top priority – but with the array of plugins, themes and core software we use, it can be challenge to stay on top of every update. Unfortunately, that leaves the door open for vulnerabilities that can completely undermine your hard work building an online presence.

Case in point is a recently disclosed critical flaw in a very popular WordPress plugin, Photo Gallery by 10Web. Used on over 200,000 sites, this plugin powers image galleries and slideshows but has a nasty directory traversal vulnerability that could allow attackers to fully take over sites by simply renaming key files like wp-config.php.

About the Plugin

Photo Gallery by 10Web is a customizable, responsive gallery plugin used by over 200,000 WordPress sites. It has over 17 million total downloads and is actively maintained by developers 10Web.

The Vulnerability Explained

Researcher Bence Szalai recently discovered a path traversal vulnerability in Photo Gallery by 10Web, meaning attackers could exploit the plugin to access directories outside the image gallery and rename files arbitrarily on the server. This impacts all versions up to and including 1.8.19. By renaming key WordPress files like wp-config.php, attackers could easily take over sites.

This vulnerability, tracked as CVE-2024-0221, has a CVSS severity score of 9.1 out of 10, making it critical.

Impacts to Users

If exploited before sites update to the patched version, this vulnerability poses severe risks including:

Complete site takeover
Data theft or manipulation
SEO damage
Reputation harm

How to Update and Secure Your Site

Update Photo Gallery by 10Web to version 1.8.20 immediately.
Check your site for signs of compromise like unexpected admin accounts, code changes, etc.
Consider switching gallery plugins - options like Envira Gallery avoid this vulnerability.
Enable automated WordPress updates for plugins, themes and core.

A History of Vulnerabilities

This is unfortunately not the first vulnerability found in Photo Gallery. There have been 42 previous security issues reported since May 2014, illustrating the ongoing maintenance required by complex plugins.

The Importance of Updates

While detailing every vulnerability out there would require its own blog, the key takeaway is this: software has bugs. Hackers find them. Updates fix them. By using automated update systems and trusted plugins, you can eliminate the headaches and rest easy knowing your site is secure.

As a business owner, you don't have time to constantly monitor for WordPress vulnerabilities like this. At Your WP Guy, we become your outsourced IT team to handle security, updates, maintenance and support. Let us fully audit your site and plugins to assess any impact from this issue. We'll update everything to patched versions so you can rest easy knowing your site is locked down.

Focus on your business goals while we focus on your WordPress site's security. Chat with us anytime during business hours, schedule a call or call 678-995-5169 for a free consultation on securing your online presence.

Photo Gallery by 10Web Vulnerability – Directory Traversal to Arbitrary File Rename – CVE-2024-0221 | WordPress Plugin Vulnerability Report FAQs

What is the vulnerability in Photo Gallery by 10Web?

The Photo Gallery plugin by 10Web has a path traversal vulnerability that was discovered in versions up to and including 1.8.19. This vulnerability allows authenticated users, like admins, to exploit the rename_item function to rename arbitrary files outside of the intended photo gallery directory on the server. For example, attackers could rename key WordPress files and take over sites.

How severe is this Photo Gallery plugin vulnerability?

This vulnerability is considered critical severity, with a CVSS base score of 9.1 out of 10. The ability of authenticated users to traverse directories and rename sensitive files enables serious impacts like malware injection, data theft, and full site takeovers by renaming wp-config.php in the root directory of the WordPress site. The ease of exploiting this vulnerability contributes to the high severity assessment.

What versions of the Photo Gallery plugin are affected?

All versions of Photo Gallery by 10Web up to and including 1.8.19 contain this vulnerability and should be updated immediately. The issue is fixed in version 1.8.20, which was released after the vulnerability was reported privately to 10Web by the security researcher Bence Szalai. So upgrading sites to 1.8.20 resolves the vulnerability.

How can I tell if my WordPress site is vulnerable?

If your WordPress site has the Photo Gallery plugin by 10Web active, you can check which version is installed by going to Plugins > Installed Plugins within your WordPress dashboard. If the version listed is 1.8.19 or below, your site is impacted and should be updated to close this security flaw. You can also use available WordPress vulnerability scanners to automatically detect if your active plugins contain any published vulnerabilities.

Is there any indication my site has been compromised?

If hackers were already able to exploit this vulnerability and modify or rename files within your WordPress installation before you upgrade, there may be signs of compromise. Unexpected new admin accounts, strange database queries, changes to files within wp-admin and wp-includes, and unexpected code snippets inserted throughout are some indicators to look for during your post-update review. Thorough scans using WordPress vulnerability tools can help detect suspected issues.

What steps should I take to update and secure my site?

First, log into your WordPress dashboard and update Photo Gallery by 10Web to version 1.8.20 within the update mechanism for Plugins. Next conduct a review for any signs of compromise already mentioned. Consider switching gallery plugins as an extra precaution, using options without known vulnerabilities currently. Make sure you have automated background updates enabled for WordPress core, plugins and themes so any future fixes can be applied promptly.

Can vulnerabilities like this lead to impacts beyond my own site being hacked?

Yes, vulnerabilities within widely-used plugins have far-reaching implications beyond just the security of your own website. Since flawed plugins are installed across hundreds of thousands of sites, they pose aggregate risks to the broader internet and provide efficient vectors for large scale attacks. Hackers often rapidly weaponize dangerous plugin flaws into global threats within days - which underscores why timely patching is so essential not just for your own site protection but for limiting the wider-spread damage.

Why do plugins tend to have frequent vulnerabilities like this?

By nature plugins add a lot of complex code and features that expand attack surface area for hackers to probe. Just like any software, bugs and flaws inevitably arise in plugins – especially free plugins maintained by small teams. The challenge is the volume and frequency of plugins used on most WordPress sites creates multiplying risk. Using the essentials, keeping them updated, monitoring for issues and being ready to switch away from problematic plugins are all key for balancing functionality with security for your website.

What should I do if I need help evaluating or securing my site?

If after learning about vulnerabilities like this you have concerns about flaws existing on your website, the best thing to do is connect with a trusted WordPress developer or agency to conduct an audit. They can scan for known vulnerabilities, review your plugins and setup, make upgrade and configuration recommendations tuned to your particular site’s security needs, and help ensure you don’t overlook any gaps that could lead to compromise. I’m always happy to offer this assistance as well to any readers with concerns after reading this.

Share this post:

X (Twitter) Facebook Pinterest LinkedIn Email Reddit WhatsApp Pocket SMS

Posted in Security, Vulnerabilities and tagged 10Web, arbitrary file rename, critical vulnerability, CVE-2024-0221, CVSS 9.1, database security, file traversal, hacking, patches, photo gallery, Plugins, Site Security, updates, vulnerability, WordPress