CVE-2024-35721: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery WordPress plugin affecting versions through 1.4.5. The vulnerability was initially reported on February 7, 2024, and publicly disclosed on June 6, 2024. This security issue has been assigned CVE-2024-35721 and affects the plugin's core functionality (Patchstack).

The vulnerability stems from a missing capability check on the _ajax_image_gallery and _ig_save_settings functions. The issue has received a CVSS v3.1 base score of 8.8 (HIGH) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Patchstack assigned a CVSS score of 4.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-862 (Missing Authorization) (NVD).

The vulnerability allows authenticated attackers with subscriber-level access and above to modify plugin settings without proper authorization. This broken access control issue could lead to unauthorized modification of data within the plugin's configuration (WPScan).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. No public exploits have been reported in the wild at the time of disclosure (Patchstack).

Users are advised to update to version 1.4.6 or later of the Image Gallery plugin, which contains the fix for this vulnerability. Patchstack has also issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).