Supersystic Photo Gallery by Supsystic plugins up to version 1.21.6 contain a Cross‑Site Request Forgery flaw whereby an attacker can cause an authenticated WordPress user to unknowingly submit crafted requests through the gallery feature. The vulnerability allows the attacker to instruct a logged‑in user to perform actions with the user’s privileges, potentially leading to unauthorized data modification or configuration changes. This weakness belongs to CWE‑352 and can compromise the integrity of user‑managed content.

All installations of the WordPress Photo Gallery by Supsystic plugin whose version is 1.21.6 or earlier are affected. The plugin is distributed under the vendor name Supsystic and is commonly used in WordPress sites to manage image galleries. No other WordPress core components are directly impacted.

The CVSS score of 6.3 indicates a moderate severity that can be exploited with knowledge of the target site and a victim who is logged in with sufficient privileges. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a user visiting a malicious or crafted page while authenticated to the compromised WordPress site; the page then triggers an unintended request to the gallery endpoint. No additional privilege escalation is required beyond the victim’s existing session.