A Cross‑Site Request Forgery (CSRF) vulnerability exists in the 10Web Photo Gallery plugin up to version 1.8.37. The flaw allows an attacker to trick a user into submitting a request that the plugin processes as if the user had intentionally performed that action. The potential impact is the covert execution of privileged actions—such as modifying gallery settings, uploading content, or deleting existing entries—within the victim’s account.

The affected product is 10Web’s Photo Gallery by 10Web plugin, specifically all releases from the initial version up to and including 1.8.37.

The CVSS score is 4.3, indicating a medium severity impact. EPSS is listed as less than 1 %, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker co‑axing an authenticated user to visit a malicious page that submits a forged request to the vulnerable plugin. No additional exploitation prerequisites are described in the available data.