The bPlugins Image Gallery block – Create and display photo gallery/photo album plugin contains a missing authorization flaw that allows attackers to access administrative functionality without proper credentials. This vulnerability can lead to unauthorized modification, deletion, or disclosure of gallery data, and compromises the confidentiality, integrity, and availability of the site’s media management capabilities. The weakness is identified as a classic missing access control issue.

This vulnerability affects the bPlugins Image Gallery block – Create and display photo gallery/photo album plugin for all versions from the first release up to and including 1.0.7. No later versions are currently affected.

The CVSS score of 7.1 places this flaw in the high-risk range, while the EPSS score of less than 1% indicates that exploitation is currently expected to be rare. It is not listed in the CISA KEV catalog. Attackers can exploit the issue by sending unauthenticated HTTP requests to the plugin’s administrative endpoints, assuming these endpoints are exposed to the network. Once reached, the attacker can perform gallery management actions normally reserved for privileged users. The vulnerability requires no special user privileges or additional exploits, making it straightforward for a remote attacker to test and exploit.