The WP AUDIO GALLERY plugin for WordPress is vulnerable due to missing capability checks and the absence of nonce verification in the wpag_htaccess_callback function. This flaw allows an attacker who has authenticated access at the subscriber level or higher to overwrite the site’s .htaccess file with arbitrary content. In certain server configurations, this manipulation can enable the attacker to read files on the server that should otherwise be protected, representing an unauthorized data disclosure risk.

Any installation of the WP AUDIO GALLERY plugin version 2.0 or earlier, developed by the vendor husainali52. The vulnerability exists for all WordPress sites that have the plugin activated and do not have a patched version installed.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The flaw is not yet listed in CISA’s KEV catalog. The attack can be carried out from a web browser after an attacker has authenticated with a WordPress account that has subscriber or higher privileges, and the plugin’s callback then writes malicious data to the server’s .htaccess file. Once the file is altered, the attacker can read sensitive files, potentially leading to further compromise.