The Gallery by FooGallery plugin for WordPress contains a missing capability check in its ajax_get_gallery_info() function, allowing subscribers and higher-privileged users to request metadata for private, draft, or password‑protected galleries. An attacker who can log in with a Subscriber account can enumerate gallery IDs and retrieve names, image counts, and thumbnail URLs, exposing sensitive details about unsanctioned content. The weakness aligns with CWE‑862, highlighting insufficient authorization checks for data access.

Fooplugins off the Gallery by FooGallery plugin, all released versions up to and including 3.1.9 are affected. Any WordPress installation using these versions can potentially expose private gallery metadata to authenticated users.

The CVSS score is 4.3, indicating moderate severity, while the EPSS score of less than 1% shows low likelihood of exploitation. The vendor is not listed in CISA KEV. Exploitation requires an authenticated session with at least Subscriber role and access to the site’s AJAX endpoint; an attacker can retrieve gallery metadata by iterating over gallery identifiers, but no code execution or privilege escalation is possible.