Album and Image Gallery with Lightbox – Flagallery Photo Portfolio < 2.53 - Sensitive Information Disclosure
Strategic Overview
< 2.53N/AVulnerability Overview
The Album and Image Gallery with Lightbox – Flagallery Photo Portfolio plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.52 via the 'dir' parameter in the admin/ajax.php file, the 'want2read' parameter in the admin/news.php file, and the 'f' parameter in the facebook.php file. This makes it possible for authenticated attackers to determine the existence of directories.
Technical Analysis
REMEDIATION: Update to version 2.53, or a newer patched version --- IDENTIFIER: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C