CVE-2024-33586: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in Photo Gallery by 10Web WordPress plugin affecting versions through 1.8.20. The vulnerability was reported by Steven Julian on January 23, 2024, and was publicly disclosed on April 25, 2024, receiving the identifier CVE-2024-33586 (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 base score of 5.3 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating that it can be exploited over the network with low attack complexity, requires no privileges or user interaction, and has a limited impact on integrity (Patchstack).

The vulnerability allows unprivileged users to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks in specific functions (Patchstack).

The vulnerability is considered to have a low severity impact and is unlikely to be exploited. It can be triggered by unauthenticated users, though specific exploit details have not been publicly disclosed (Patchstack).

Users are advised to update to version 1.8.21 or later to remediate this vulnerability. The fix was released as part of version 1.8.21 of the Photo Gallery by 10Web plugin (Patchstack).