CVE-2019-25149
Last modified
CVE-2019-25149 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This allows authenticated attackers with any capability level to deactivate any plugin on the site, including plugins necessary to site functionality or security.. EPSS estimates a 0.61% chance of exploitation in the next 30 days.
Description
The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This allows authenticated attackers with any capability level to deactivate any plugin on the site, including plugins necessary to site functionality or security.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Robogallery | Gallery Images Ape | <= 2.0.6 |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd6c2b8-b00c-49d1-930f-50397e742ac5?source=cveBroken Link, Third Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd6c2b8-b00c-49d1-930f-50397e742ac5?source=cveBroken Link, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-25149?
How severe is CVE-2019-25149?
How do I fix CVE-2019-25149?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-25143The GDPR Cookie Compliance plugin for WordPress is vulnerabl…4.3
- CVE-2019-25144The WP HTML Mail plugin for WordPress is vulnerable to HTML …6.1
- CVE-2019-25145The Contact Form & SMTP Plugin by PirateForms plugin for Wor…6.1
- CVE-2019-25146The DELUCKS SEO plugin for WordPress is vulnerable to Stored…6.1
- CVE-2019-25147The Pretty Links plugin for WordPress is vulnerable to Store…6.1
- CVE-2019-25148The WP HTML Mail plugin for WordPress is vulnerable to HTML …6.1
- CVE-2019-25150The Email Templates plugin for WordPress is vulnerable to HT…8.8
- CVE-2019-25151The Funnel Builder plugin for WordPress is vulnerable to aut…4.3
- CVE-2019-25152The Abandoned Cart Lite for WooCommerce and Abandoned Cart P…6.1
- CVE-2019-25154Inappropriate implementation in iframe in Google Chrome prio…9.6
- CVE-2019-25155DOMPurify before 1.0.11 allows reverse tabnabbing in demos/h…6.1
- CVE-2019-25156A vulnerability classified as problematic was found in dstar…6.1
Are you affected by CVE-2019-25149?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST