CVE-2024-0221 Overview
The Photo Gallery by 10Web plugin for WordPress contains a directory traversal vulnerability in the rename_item function. The flaw affects all versions up to and including 1.8.19. Authenticated attackers can rename arbitrary files on the underlying server through path manipulation. Renaming sensitive files such as wp-config.php breaks WordPress bootstrapping and can trigger the setup flow, enabling full site takeover. By default the action requires administrator privileges, but the premium version allows administrators to delegate gallery management to lower-privileged users, potentially exposing the issue to contributor-level accounts.
Critical Impact
Renaming wp-config.php can lead to complete WordPress site takeover through database reconfiguration during the WordPress installation flow.
Affected Products
- 10Web Photo Gallery plugin for WordPress, versions up to and including 1.8.19
- WordPress installations running the free photo-gallery plugin
- WordPress installations running the premium Photo Gallery plugin with delegated gallery management
Discovery Timeline
- 2024-02-05 - CVE-2024-0221 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0221
Vulnerability Analysis
The vulnerability is a path traversal weakness [CWE-22] in the plugin's file manager controller. The rename_item function accepts user-supplied file name parameters and passes them to filesystem operations without sanitizing traversal sequences such as ../. An authenticated attacker can craft a rename request that escapes the intended gallery directory and targets any file the web server user can write.
Renaming wp-config.php is the highest-impact abuse path. WordPress cannot locate its database credentials once the file is renamed and returns the installation wizard. An attacker can then point WordPress at an attacker-controlled database, create a new administrator account, and gain full control of the site.
The plugin exposes the vulnerable handlers through the WordPress admin AJAX interface. Relevant sinks are documented in the plugin's file manager controller at lines 291 and 441. Review the WordPress Gallery File Manager Code for the exact code path.
Root Cause
The root cause is missing input validation on file name parameters used by the rename_item handler. The plugin trusts operator input rather than resolving the target path and verifying it is contained within the gallery upload directory.
Attack Vector
Exploitation requires an authenticated session with gallery management rights. The attacker issues a rename request over HTTP that includes directory traversal sequences in the source or destination file name. See the Wordfence Vulnerability Report for additional exploitation context.
No public proof of concept code is referenced in the advisory. The vulnerability is described in prose only; refer to the vendor patch changeset for the exact vulnerable and fixed logic.
Detection Methods for CVE-2024-0221
Indicators of Compromise
- Unexpected renames of wp-config.php, .htaccess, or other WordPress core files on disk
- Presence of a WordPress installation wizard on a previously configured site
- Creation of new administrator accounts immediately after suspicious plugin activity
- Web server access logs showing POST requests to admin-ajax.php with photo-gallery actions containing ../ sequences
Detection Strategies
- Inspect WordPress request logs for admin-ajax.php calls invoking Photo Gallery file manager actions with traversal patterns in file name parameters
- Compare the installed plugin version against 1.8.20 or later across the WordPress fleet
- Monitor filesystem integrity for renames touching files outside the plugin's upload directories, particularly wp-config.php
Monitoring Recommendations
- Enable WordPress audit logging for plugin actions performed by administrators and contributors
- Alert on filesystem changes to WordPress root files and configuration files
- Track new administrator user creation events and correlate against plugin activity within a short time window
How to Mitigate CVE-2024-0221
Immediate Actions Required
- Update the Photo Gallery by 10Web plugin to version 1.8.20 or later on every WordPress site
- Audit assigned gallery management capabilities in the premium version and revoke access from non-trusted roles
- Verify integrity of wp-config.php and other WordPress core files, and restore from backup if renamed
Patch Information
The vendor addressed the issue in the plugin's SVN repository. Review the fix in the WordPress Photo Gallery Changeset. Apply the patched version through the WordPress plugin updater or by replacing the plugin files.
Workarounds
- Deactivate the Photo Gallery plugin until the update to 1.8.20 or later is applied
- Restrict administrator delegation of gallery management to trusted accounts only
- Deploy a web application firewall rule that blocks admin-ajax.php requests containing ../ sequences in Photo Gallery parameters
# Update the plugin via WP-CLI
wp plugin update photo-gallery --version=1.8.20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
