Login Sign Up

CVE-2023-3154

7.5 HIGH

📋 TL;DR

This vulnerability in the WordPress Gallery Plugin allows attackers to perform PHAR deserialization attacks by exploiting insufficient input validation in the gallery_edit function. Attackers can potentially access arbitrary server resources, leading to remote code execution or sensitive data exposure. All WordPress sites running Gallery Plugin versions before 3.39 are affected.

💻 Affected Systems

Products:
  • WordPress Gallery Plugin
Versions: All versions before 3.39
Operating Systems: All
Default Config Vulnerable: ⚠️ Yes
Notes: Requires WordPress installation with Gallery Plugin installed and activated

📦 What is this software?

Nextgen Gallery by Imagely

View all CVEs affecting Nextgen Gallery →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete server compromise, data theft, or ransomware deployment

🟠

Likely Case

File inclusion leading to sensitive file disclosure, limited code execution, or plugin/theme manipulation

🟢

If Mitigated

Attack blocked at WAF level or fails due to proper file permissions

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires authenticated access to WordPress with gallery editing permissions

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.39

Vendor Advisory: https://wpscan.com/vulnerability/ed099489-1db4-4b42-9f72-77de39c9e01e

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Gallery Plugin'
4. Click 'Update Now' if available
5. If no update available, download version 3.39+ from WordPress repository
6. Deactivate, delete old version, upload and activate new version

🔧 Temporary Workarounds

Disable Gallery Plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate gallery-plugin

Restrict User Permissions

all

Limit gallery editing capabilities to trusted administrators only

🧯 If You Can't Patch

  • Implement WAF rules to block PHAR deserialization attempts
  • Restrict file system access permissions for web server user

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Gallery Plugin version number

Check Version:

wp plugin get gallery-plugin --field=version

Verify Fix Applied:

Confirm Gallery Plugin version is 3.39 or higher in WordPress admin

📡 Detection & Monitoring

Log Indicators:

  • POST requests to gallery_edit endpoint with unusual parameters
  • File inclusion attempts in web server logs
  • PHP warnings about unserialize() or include()

Network Indicators:

  • HTTP requests containing 'phar://' protocol in parameters
  • Unusual file paths in gallery-related API calls

SIEM Query:

source="web_server" AND (uri_path="*gallery_edit*" AND (param="*phar://*" OR param="*://*"))

📊 Metadata

CVE ID: CVE-2023-3154
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: October 16, 2023
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON