CVE-2024-35721: Awplife Image Gallery Auth Bypass Flaw

CVE-2024-35721 Overview

CVE-2024-35721 is a Missing Authorization vulnerability [CWE-862] in the A WP Life Image Gallery WordPress plugin, also marketed as Lightbox Gallery, Responsive Photo Gallery, and Masonry Gallery. The flaw affects all versions up to and including 1.4.5. An authenticated attacker with low privileges can invoke plugin functions that lack proper capability checks, leading to broken access control across the plugin's administrative actions. The vulnerability is exploitable over the network with low attack complexity and requires no user interaction.

Critical Impact
An authenticated user with minimal privileges can perform unauthorized actions against the plugin, compromising confidentiality, integrity, and availability of the WordPress site.

Affected Products

A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery
Versions from n/a through 1.4.5
WordPress installations running the awplife/image_gallery plugin

Discovery Timeline

2024-06-10 - CVE-2024-35721 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35721

Vulnerability Analysis

The plugin exposes one or more action handlers that do not verify the caller's WordPress capability before executing privileged operations. This is a classic Broken Access Control weakness classified under [CWE-862]. An authenticated user, including a low-privileged subscriber-level account, can send crafted requests to these endpoints and trigger administrative functionality. The plugin trusts the authenticated session without enforcing a current_user_can() check or a valid nonce tied to a privileged capability.

Successful exploitation impacts confidentiality, integrity, and availability of the affected WordPress site. Attackers can modify gallery configuration, manipulate stored content, or trigger destructive operations exposed through the plugin's admin actions. Combined with WordPress sites that allow open user registration, the attack surface expands significantly.

Root Cause

The root cause is the absence of authorization checks on plugin AJAX or admin-post handlers. The plugin registers callbacks for actions such as gallery create, update, or delete operations without gating them behind capability verification. WordPress routes any authenticated request to these hooks, so subscriber or contributor roles reach code paths meant for administrators.

Attack Vector

The attacker first authenticates to the target WordPress site using any valid account. The attacker then issues an HTTP POST to wp-admin/admin-ajax.php or admin-post.php targeting the vulnerable plugin action. Because the handler does not validate the user's role, the request executes with full effect. Refer to the Patchstack Vulnerability Advisory for the specific action names and parameter details.

Detection Methods for CVE-2024-35721

Indicators of Compromise

Unexpected changes to image gallery entries, metadata, or plugin settings in the WordPress database tables associated with awplife galleries.
POST requests to admin-ajax.php or admin-post.php originating from low-privileged user sessions targeting plugin-specific action parameters.
New or modified gallery records created outside of administrator accounts in access logs.

Detection Strategies

Review web server access logs for authenticated requests to plugin endpoints from non-administrator accounts.
Correlate WordPress user role data with the source of plugin action requests to identify privilege mismatches.
Monitor plugin database tables for changes not attributable to a legitimate administrative session.

Monitoring Recommendations

Enable WordPress audit logging to record all plugin actions with the invoking user ID and role.
Alert on repeated POST requests to admin-ajax.php with plugin action values from the same low-privileged account.
Track outbound changes to wp_options and plugin-specific tables for unauthorized modifications.

How to Mitigate CVE-2024-35721

Immediate Actions Required

Update the A WP Life Image Gallery plugin to a version later than 1.4.5 as soon as a patched release is available from the vendor.
Audit WordPress user accounts and remove or disable any unnecessary low-privileged registrations.
Restrict open user registration on public WordPress sites where the plugin is installed.

Patch Information

Consult the Patchstack Vulnerability Advisory for the fixed version and vendor update guidance. Apply the vendor-supplied update through the WordPress plugin manager or by replacing the plugin files directly.

Workarounds

Deactivate the A WP Life Image Gallery plugin until a patched version is deployed if the plugin is not business-critical.
Deploy a Web Application Firewall (WAF) rule that blocks requests to the plugin's vulnerable action handlers from non-administrator sessions.
Set the WordPress users_can_register option to false to reduce the pool of authenticated attackers.

bash

# Disable open registration in wp-config.php or via WP-CLI
wp option update users_can_register 0

# Deactivate the vulnerable plugin until patched
wp plugin deactivate image-gallery