Technical impact
This vulnerability is a missing authorization flaw that enables users to bypass intended access controls. By exploiting incorrectly configured security levels, an attacker can view, modify, or delete gallery content that should be restricted. The weakness is classified as CWE‑862 and results in unauthorized data access, potentially undermining data confidentiality and integrity. The description provides no indication of remote code execution or denial of service.
Affected Systems
The flaw affects the FooPlugins FooGallery WordPress plugin. Any site running FooGallery version 3.1.11 or earlier is potentially impacted. The description does not enumerate specific minor releases beyond the threshold, so all releases through 3.1.11 are vulnerable.
Risk and Exploitability
The CVSS score of 4.3 indicates a medium‑low severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild at the time of analysis. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to leverage incorrect access control settings within the plugin, implying a web‑application level attack that requires access to the WordPress administrative interface or knowledge of user roles.
