CVE-2024-3581: 
WordPress vulnerability analysis and mitigation

The MaxGalleria plugin for WordPress contains an unauthorized image upload vulnerability (CVE-2024-3581) due to a missing capability check in the add_media_library_images_to_gallery function in versions up to and including 6.4.2. This security flaw allows authenticated attackers with subscriber-level access or higher to upload arbitrary images to a gallery (NVD).

The vulnerability stems from insufficient access control in the add_media_library_images_to_gallery function. The CVSS v3.1 base score is 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. This indicates the vulnerability requires network access, low attack complexity, low privileges, no user interaction, and has a limited impact on integrity (Wordfence).

The vulnerability allows authenticated users with subscriber-level access or higher to bypass intended access controls and upload arbitrary images to galleries. This could potentially be exploited to upload inappropriate content or consume server storage resources (NVD).

The vulnerability requires an authenticated user account with at least subscriber-level access. The attack complexity is considered low, requiring no special conditions or user interaction to exploit (Wordfence).

Users should update to a version newer than 6.4.2 if available. If updating is not immediately possible, consider restricting subscriber role access or implementing additional access controls at the web application level (NVD).