CVE-2024-10535
Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion
Summary
Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion
Original description
The description as published by the source.
The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the remove_unused_thumbnails() function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails in the video-wc-gallery-thumb directory.
References
- advisory github.com
- advisory nvd.nist.gov
- web plugins.trac.wordpress.org
- web plugins.trac.wordpress.org
- web wordfence.com