CVE-2024-35720: Awplife Album Gallery Auth Bypass Flaw

CVE-2024-35720 Overview

CVE-2024-35720 is a Missing Authorization vulnerability [CWE-862] in the A WP Life Album Gallery – WordPress Gallery plugin. The flaw affects all plugin versions up to and including 1.5.7. Authenticated attackers with low privileges can invoke plugin functions that lack proper capability checks. Successful exploitation impacts the confidentiality, integrity, and availability of the affected WordPress site.

Critical Impact
Low-privileged authenticated users can access administrative plugin functionality, enabling data modification and site compromise on WordPress installations running Album Gallery 1.5.7 or earlier.

Affected Products

A WP Life Album Gallery – WordPress Gallery plugin, versions up to and including 1.5.7
WordPress sites running the awplife/album_gallery component
Any WordPress installation with the vulnerable plugin activated

Discovery Timeline

2024-06-10 - CVE-2024-35720 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35720

Vulnerability Analysis

The Album Gallery plugin exposes plugin actions without verifying the caller's WordPress capabilities. Missing Authorization vulnerabilities [CWE-862] occur when code executes sensitive operations without confirming the user is permitted to perform them. In this plugin, an authenticated user holding minimal privileges such as subscriber can reach handlers that should be restricted to administrators.

Because the vulnerability requires authentication but no user interaction, exploitation is straightforward against any WordPress site that permits open registration or exposes low-privileged accounts. The plugin's action handlers do not enforce a current_user_can() check or verify nonces before performing state-changing operations.

Root Cause

The root cause is the absence of capability verification in the plugin's request handlers. WordPress plugins must gate privileged actions using current_user_can() with an appropriate capability such as manage_options and validate a nonce via check_admin_referer() or wp_verify_nonce(). Album Gallery 1.5.7 and earlier omit these controls on affected endpoints.

Attack Vector

An attacker first obtains any authenticated session on the target WordPress site. The attacker then sends crafted HTTP requests to the unprotected plugin actions, invoking functionality reserved for higher-privileged roles. The Patchstack advisory documents this as a broken access control condition. See the Patchstack Vulnerability Report for technical details.

No verified public exploit code is available at the time of writing.

Detection Methods for CVE-2024-35720

Indicators of Compromise

Unexpected modifications to gallery configuration, media entries, or plugin options attributable to non-administrator accounts
HTTP POST requests to admin-ajax.php or plugin action endpoints originating from subscriber or contributor sessions
New or altered gallery objects created outside normal administrator workflows

Detection Strategies

Audit WordPress activity logs for privileged plugin actions executed by non-admin roles
Review web server access logs for repeated requests to Album Gallery endpoints from newly registered accounts
Compare plugin file integrity and database options against a known-good baseline

Monitoring Recommendations

Enable a WordPress audit plugin to record capability-relevant events and role changes
Alert on newly registered users that immediately issue POST requests to plugin admin actions
Monitor for anomalous wp-admin/admin-ajax.php traffic containing Album Gallery action parameters

How to Mitigate CVE-2024-35720

Immediate Actions Required

Update the Album Gallery – WordPress Gallery plugin to a version newer than 1.5.7 as soon as a fixed release is available
Deactivate and remove the plugin on sites where it is not in active use
Review WordPress user accounts and remove untrusted subscribers or contributors
Rotate credentials for any low-privileged accounts that may have been compromised

Patch Information

Refer to the Patchstack Vulnerability Report for the latest patch status and vendor-supplied fix guidance. Apply the vendor update through the WordPress plugin manager once available.

Workarounds

Disable open user registration in Settings > General to reduce the attacker pool
Restrict access to wp-admin/admin-ajax.php at the web application firewall for unauthenticated and low-privileged sessions where feasible
Temporarily deactivate the Album Gallery plugin until a patched release is installed

bash

# Disable the Album Gallery plugin using WP-CLI until a fix is deployed
wp plugin deactivate new-album-gallery
wp plugin status new-album-gallery