CVSS 3.1 Score 9.1 of 10 (high)


Published Feb 5, 2024
Updated: Feb 13, 2024


CVE-2024-0221 is a vulnerability affecting the Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress. This vulnerability allows authenticated attackers to perform Directory Traversal, specifically through the rename_item function. It enables them to rename arbitrary files on the server, potentially leading to site takeovers if sensitive files like wp-config.php can be renamed. Initially, only administrators can exploit this vulnerability, but in the premium version of the plugin, lower-level users can also exploit it if given gallery management permissions. This vulnerability has a base severity rating of CRITICAL and a base score of 9.1 according to [email protected]. It has a high impact on integrity and confidentiality and requires high privileges for exploitation. The attack vector is through the network, and there is no user interaction required. The availability impact is also high.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-0221 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options