CVE-2024-49325: Photo Gallery Builder Auth Bypass Flaw

CVE-2024-49325 Overview

CVE-2024-49325 is a missing authorization vulnerability [CWE-862] affecting the wpdiscover Photo Gallery Builder plugin for WordPress. The flaw exists in all versions up to and including 3.0 and results from functionality that is not properly constrained by access control lists (ACLs). An authenticated attacker with low privileges can access administrative functionality intended for higher-privileged users, specifically the notice dismissal handler exposed by the plugin.

Critical Impact
An authenticated attacker with low-level WordPress privileges can invoke plugin functionality that should be restricted, leading to compromise of confidentiality, integrity, and availability of the affected site.

Affected Products

wpdiscover Photo Gallery Builder plugin for WordPress
All versions from n/a through 3.0
WordPress sites with the photo-gallery-builder plugin installed and activated

Discovery Timeline

2024-10-20 - CVE-2024-49325 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49325

Vulnerability Analysis

The vulnerability stems from a broken access control condition in the Photo Gallery Builder plugin. The plugin exposes a notice dismissal handler that fails to verify the caller's role or capability before executing privileged logic. Any authenticated user, including low-privileged roles such as Subscriber, can trigger the handler.

Because WordPress plugins frequently register administrative AJAX actions under wp_ajax_* hooks, any such action that omits a current_user_can() capability check inherits the privileges of the underlying function. In this case, the plugin does not enforce authorization on the dismissal endpoint, permitting unauthorized state changes.

The attack requires network access to the WordPress site and valid authenticated credentials of any privilege level. No user interaction is needed beyond the attacker's own request. See the Patchstack Vulnerability Report for further technical context.

Root Cause

The root cause is the absence of authorization checks on a plugin handler. WordPress requires developers to verify user capabilities using functions such as current_user_can() and to validate nonces via check_ajax_referer(). The plugin omits these guards, violating the principle of least privilege and enabling privilege escalation for authenticated users.

Attack Vector

An attacker authenticates to the target WordPress site using any valid low-privileged account. The attacker then sends a crafted HTTP POST request to the vulnerable AJAX endpoint registered by the Photo Gallery Builder plugin. Because the handler does not validate the requester's role, the plugin executes the requested action on behalf of the attacker.

No verified proof-of-concept code is publicly available for CVE-2024-49325. Refer to the linked Patchstack advisory for exploitation specifics.

Detection Methods for CVE-2024-49325

Indicators of Compromise

Unexpected admin-ajax.php POST requests referencing Photo Gallery Builder action names, originating from low-privileged user sessions
Changes to plugin option values or dismissed notice flags without corresponding administrator activity
Authentication events from Subscriber or Contributor accounts immediately followed by administrative AJAX calls

Detection Strategies

Enumerate WordPress installations for the photo-gallery-builder plugin at versions <= 3.0 using site inventory or WPScan-based scanning
Review web server access logs for POST requests to /wp-admin/admin-ajax.php correlated with plugin-specific action parameters
Alert on privilege mismatches where non-administrative sessions invoke administrative plugin actions

Monitoring Recommendations

Enable WordPress audit logging to capture plugin option changes and AJAX action invocations with the associated user role
Forward web and application logs to a centralized SIEM or data lake for correlation across authentication and request telemetry
Track anomalous request patterns from newly registered or low-privileged accounts targeting admin-ajax.php

How to Mitigate CVE-2024-49325

Immediate Actions Required

Identify all WordPress sites running Photo Gallery Builder version 3.0 or earlier and inventory active user accounts
Restrict user registration on public-facing WordPress sites where the plugin is installed until remediated
Audit recent low-privileged account activity for suspicious AJAX invocations tied to the plugin
Rotate credentials for any accounts showing signs of abuse

Patch Information

At the time of publication, no fixed version was listed in the NVD entry for CVE-2024-49325; the advisory documents impact through version 3.0. Administrators should consult the Patchstack Vulnerability Report and the plugin's WordPress.org page for the latest patched release, then upgrade all affected installations.

Workarounds

Deactivate and remove the Photo Gallery Builder plugin until a patched version is confirmed installed
Apply a Web Application Firewall (WAF) rule to block requests to the vulnerable admin-ajax.php action from non-administrative sessions
Enforce least-privilege role assignment and disable open user registration where not required

bash

# Configuration example: disable the plugin site-wide via WP-CLI while a patch is evaluated
wp plugin deactivate photo-gallery-builder --all
wp plugin status photo-gallery-builder