CVE-2024-10535: Video Gallery For WooCommerce Auth Bypass

CVE-2024-10535 Overview

The Video Gallery for WooCommerce plugin for WordPress contains a missing authorization vulnerability in the remove_unused_thumbnails() function. All versions up to and including 1.31 lack a capability check on this function. Unauthenticated attackers can send crafted requests to delete thumbnails stored in the video-wc-gallery-thumb directory. The flaw is classified as [CWE-862] Missing Authorization and affects the martinvalchev:video_gallery_for_woocommerce component.

Critical Impact

Unauthenticated remote attackers can delete thumbnail files from WordPress sites running vulnerable versions of the plugin, resulting in loss of gallery integrity and broken product presentation.

Affected Products

• Martinvalchev Video Gallery for WooCommerce plugin for WordPress
• All versions up to and including 1.31
• WordPress installations with the plugin active

Discovery Timeline

• 2024-11-06 - CVE-2024-10535 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10535

Vulnerability Analysis

The vulnerability resides in the remove_unused_thumbnails() function within the plugin's admin interface. The function is registered as an accessible endpoint but omits a WordPress capability check and lacks nonce verification. Any HTTP client can invoke the function without authenticating to the WordPress instance.

Once invoked, the function iterates over files in the video-wc-gallery-thumb directory and removes thumbnails it considers unused. Because the invocation path bypasses privilege enforcement, an attacker controls when and whether these deletions occur. The impact is limited to integrity loss on stored thumbnail assets, with no direct confidentiality or availability impact on the site itself.

Root Cause

The root cause is a missing current_user_can() capability check on the AJAX or admin-side handler that exposes remove_unused_thumbnails(). WordPress plugins are expected to gate destructive filesystem operations behind capability checks such as manage_options and to validate nonces via check_ajax_referer(). Neither control is present in vulnerable releases, leaving the function callable by anonymous requesters.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends an HTTP request to the plugin endpoint that dispatches remove_unused_thumbnails(). No authentication, user interaction, or elevated privileges are required. Attackers can automate the request across many WordPress sites indexed as running the plugin, causing repeated deletion of thumbnails as new ones are generated.

No public proof-of-concept exploit is listed in Exploit-DB, and the vulnerability is not tracked in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability score is approximately 0.4%, indicating low observed exploitation likelihood as of the scoring date.

See the WordPress Plugin Admin Setup source and the Wordfence Vulnerability Analysis for the vulnerable code location and technical write-up.

Detection Methods for CVE-2024-10535

Indicators of Compromise

• Unexpected deletion of files within the wp-content/uploads/video-wc-gallery-thumb/ directory
• Unauthenticated HTTP requests to admin-ajax.php invoking the remove_unused_thumbnails action
• Broken thumbnail rendering in WooCommerce product video galleries following unexplained file loss
• Repeated regeneration of thumbnails followed by prompt deletion in web server access logs

Detection Strategies

• Monitor WordPress access logs for POST requests to wp-admin/admin-ajax.php referencing the remove_unused_thumbnails action from unauthenticated sessions
• Track filesystem change events on the video-wc-gallery-thumb directory using file integrity monitoring tools
• Correlate anomalous HTTP request patterns targeting the plugin endpoint against the source IP reputation

Monitoring Recommendations

• Enable WordPress access logging with request body capture for admin-ajax.php endpoints
• Deploy file integrity monitoring across wp-content/uploads/ subdirectories used by active plugins
• Alert on repeated unauthenticated calls to plugin AJAX handlers, particularly those that mutate state

How to Mitigate CVE-2024-10535

Immediate Actions Required

• Update the Video Gallery for WooCommerce plugin to a version later than 1.31 as soon as a patched release is available
• Deactivate and remove the plugin if no patched version is available and thumbnail management is not business-critical
• Restrict access to wp-admin/admin-ajax.php from untrusted networks using a web application firewall rule
• Back up the video-wc-gallery-thumb directory to allow restoration if thumbnails are deleted

Patch Information

Review the WordPress Changeset Log for the plugin repository commit associated with the fix. Administrators should confirm the installed version reports higher than 1.31 and that the remove_unused_thumbnails() handler now includes a capability check and nonce validation.

Workarounds

• Block unauthenticated POST requests to the vulnerable AJAX action at the WAF or reverse proxy layer
• Apply filesystem permissions on video-wc-gallery-thumb that prevent the web server user from deleting files if operationally acceptable
• Disable the plugin until the vendor publishes a fix, particularly on high-traffic e-commerce sites

# Example ModSecurity rule to block unauthenticated calls to the vulnerable action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,id:1010535,phase:2,deny,status:403,msg:'Block CVE-2024-10535 exploitation attempt'"
SecRule ARGS:action "@streq remove_unused_thumbnails" \
    "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"