CVE-2023-1427

MEDIUM 4.9 CVSS 3.1

Published: April 17, 2023
Last modified: June 17, 2026
NVD status: Modified
Reported by: contact@wpscan.com
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Description

- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.

Affected WordPress components

Photo Gallery by 10Web – Mobile-Friendly Image Gallery Plugin · photo-gallery

Possible match Active

Before 1.8.15
View on WordPress.org
Photo Gallery Theme · photo-gallery

Possible match Active

Before 1.8.15
View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

Unknown Photo Gallery by 10Web — Before 1.8.15
10web photo_gallery — Before 1.8.15

References

wpscan.com https://wpscan.com/vulnerability/c8917ba2-4cb3-4b09-8a49-b7c612254946 Exploit, Third Party Advisory
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected WordPress components

Affected products and versions

References