Description

WordPress Plugin WORDPRESS VIDEO GALLERY is prone to an open email relay vulnerability that lets attackers send mass emails without authentication. An attacker could exploit this issue to send unsolicited spam email to an unrestricted number of email addresses. WordPress Plugin WORDPRESS VIDEO GALLERY version 2.8 is vulnerable; other versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

http://www.homelab.it/index.php/2015/05/22/wordpress-video-gallery-2-8-unprotected-mail-page/

https://www.exploit-db.com/exploits/37106/

http://packetstormsecurity.com/files/132015/WordPress-Video-Gallery-2.8-Unprotected-Mail-Page.html

Related Vulnerabilities

WordPress Plugin Product Addons & Fields for WooCommerce Cross-Site Scripting (32.0.6)

WordPress Plugin Duplicate Page and Post Spam Injection (2.1.1)

Frontaccounting Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2009-4037)

WordPress Plugin Gallery-Flagallery Photo Portfolio Cross-Site Request Forgery (3.01)

WordPress Plugin Sitemap Index Cross-Site Scripting (1.2.3)

Severity

High

Classification

CWE-264 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update