CVE-2024-5021: WordPress Picture / Portfolio / Media Gallery <= 3.0.1 - Unauthenticated Server-Side Request Forgery
First published: Wed Jun 19 2024(Updated: )
The WordPress Picture / Portfolio / Media Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.1 via the 'file_get_contents' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress Portfolio Gallery | <=3.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-5021?
CVE-2024-5021 has a medium severity rating due to its potential for unauthorized remote access via Server-Side Request Forgery.
How do I fix CVE-2024-5021?
To fix CVE-2024-5021, update the WordPress Picture / Portfolio / Media Gallery plugin to version 3.0.2 or later.
What types of attacks are possible with CVE-2024-5021?
CVE-2024-5021 allows unauthenticated attackers to conduct Server-Side Request Forgery attacks that can lead to unauthorized web request executions.
Is CVE-2024-5021 present in all versions of the plugin?
Yes, CVE-2024-5021 affects all versions of the WordPress Picture / Portfolio / Media Gallery plugin up to and including version 3.0.1.
Who is affected by CVE-2024-5021?
Any website using the WordPress Picture / Portfolio / Media Gallery plugin up to version 3.0.1 is at risk of CVE-2024-5021.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wordpress
- canonical/wordpress portfolio gallery