CVE-2024-31353: Slideshow Gallery Info Disclosure Flaw

CVE-2024-31353 Overview

CVE-2024-31353 is an information disclosure vulnerability in the Tribulant Slideshow Gallery plugin for WordPress. The plugin writes sensitive information to log files that can be accessed by unauthenticated network attackers. All versions of Slideshow Gallery up to and including 1.7.8 are affected. The weakness is classified under [CWE-532: Insertion of Sensitive Information into Log File].

The issue was published to the National Vulnerability Database on April 10, 2024, and disclosed through Patchstack. No public exploit code, proof-of-concept, or evidence of exploitation in the wild has been reported.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive information exposed in plugin log files, enabling reconnaissance and follow-on attacks against affected WordPress sites.

Affected Products

Tribulant Slideshow Gallery plugin for WordPress, versions up to and including 1.7.8
WordPress sites with the Slideshow Gallery Lite plugin installed and activated
Deployments where plugin log files are reachable over HTTP

Discovery Timeline

2024-04-10 - CVE-2024-31353 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31353

Vulnerability Analysis

The Tribulant Slideshow Gallery plugin logs runtime data that includes sensitive information. Because the log files reside within a web-accessible directory and lack access controls, an unauthenticated attacker can request them over the network. This falls into the Information Disclosure category and maps to CWE-532.

The attacker does not need credentials, user interaction, or elevated privileges. A single HTTP request to the predictable log path is sufficient to retrieve the exposed content. Impact is limited to confidentiality; the flaw does not directly allow modification of data or disruption of service.

Exposed log contents can support downstream attacks. Disclosed configuration values, internal paths, or user-related metadata assist an attacker in mapping the site, targeting accounts, or chaining with other WordPress vulnerabilities.

Root Cause

The root cause is improper handling of diagnostic output. The plugin writes sensitive runtime data to a log file that is stored under the plugin directory and served by the web server without authentication or .htaccess restrictions. The developer did not sanitize logged content or restrict access to the log path.

Attack Vector

Exploitation occurs over the network against the WordPress site. The attacker issues an HTTP GET request against the plugin log file path within wp-content/plugins/slideshow-gallery/. No authentication, session, or user interaction is required. See the Patchstack Vulnerability Report for advisory details.

No public proof-of-concept has been released. The vulnerability mechanism is described in prose because no verified exploit code is available.

Detection Methods for CVE-2024-31353

Indicators of Compromise

HTTP GET requests to files under /wp-content/plugins/slideshow-gallery/ targeting .log, .txt, or debug output files
Requests originating from unauthenticated sessions or unknown IP addresses that enumerate plugin directories
Web server access log entries returning HTTP 200 for plugin log file paths

Detection Strategies

Audit installed WordPress plugins and flag any Slideshow Gallery installation at version 1.7.8 or earlier
Scan the wp-content/plugins/slideshow-gallery/ directory for world-readable log files served by the web server
Review web application firewall (WAF) telemetry for requests matching plugin log file paths

Monitoring Recommendations

Forward WordPress and web server access logs to a centralized analytics pipeline for correlation
Alert on repeated unauthenticated access to files under plugin directories not intended for public consumption
Track outbound connections and follow-on authentication attempts that correlate with prior plugin log access

How to Mitigate CVE-2024-31353

Immediate Actions Required

Update the Tribulant Slideshow Gallery plugin to a version later than 1.7.8 as soon as a fixed release is available from the vendor
Delete existing plugin log files from wp-content/plugins/slideshow-gallery/ to remove already-exposed sensitive data
Rotate any credentials, tokens, or secrets that may have appeared in the disclosed log content

Patch Information

Refer to the Patchstack Vulnerability Report for the current fix status and upgrade guidance. The advisory identifies versions through 1.7.8 as affected. Confirm patched builds against the vendor changelog before deploying to production.

Workarounds

Deny web access to .log and diagnostic files inside wp-content/plugins/slideshow-gallery/ using web server rules
Add a WAF rule blocking unauthenticated requests to plugin log file paths
Deactivate and remove the Slideshow Gallery plugin if it is not required until a patched version is applied

bash

# Apache: block access to plugin log files via .htaccess
<FilesMatch "\.(log|txt)$">
    Require all denied
</FilesMatch>

# Nginx: deny access to plugin log files
location ~* /wp-content/plugins/slideshow-gallery/.*\.(log|txt)$ {
    deny all;
    return 403;
}