CVE-2024-9778

Summary

CVE-2024-9778 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the ImagePress – Image Gallery plugin for WordPress. Versions up to and including 1.2.2 are susceptible to this issue. Attackers can exploit this vulnerability by forging requests and tricking administrators into performing actions, such as clicking on a malicious link. The vulnerability stems from missing or incorrect nonce validation in the 'imagepress_admin_page' function, making it possible for unauthenticated assailants to update plugin settings, including potentially dangerous redirection URLs. This flaw poses a significant risk to WordPress sites using the ImagePress plugin and emphasizes the importance of applying security patches promptly.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.