CVE-2024-9778

The ImagePress – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the 'imagepress_admin_page' function. This makes it possible for unauthenticated attackers to update plugin settings, including redirection URLs, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/image-gallery/trunk/includes/page-settings.php#L106Product
• https://plugins.trac.wordpress.org/browser/image-gallery/trunk/includes/page-settings.php#L2Product
• https://plugins.trac.wordpress.org/browser/image-gallery/trunk/includes/page-settings.php#L267Product
• https://plugins.trac.wordpress.org/browser/image-gallery/trunk/includes/page-settings.php#L380Product
• https://plugins.trac.wordpress.org/browser/image-gallery/trunk/includes/page-settings.php#L461Product
• https://plugins.trac.wordpress.org/changeset/3167164/Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/200b3446-6107-434b-b46d-2078461f3f94?source=cveThird Party Advisory

Published

Oct 12, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9772The The Uix Shortcodes – Compatible with Gutenberg plugin fo…7.3
• CVE-2024-9773An issue was discovered in GitLab EE affecting all versions …8
• CVE-2024-9774A vulnerability was found in python-sql where unary operator…6.5
• CVE-2024-9775The Anih - Creative Agency WordPress Theme theme for WordPre…4.8
• CVE-2024-9776The ImagePress – Image Gallery plugin for WordPress is vulne…4.8
• CVE-2024-9777The Ashe theme for WordPress is vulnerable to Reflected Cros…6.1
• CVE-2024-9779A flaw was found in Open Cluster Management (OCM) when a use…7.5
• CVE-2024-9780ITS dissector crash in Wireshark 4.4.0 allows denial of serv…5.5
• CVE-2024-9781AppleTalk and RELOAD Framing dissector crash in Wireshark 4.…7.5
• CVE-2024-9782A vulnerability was found in D-Link DIR-619L B1 2.06. It has…8.8
• CVE-2024-9783A vulnerability was found in D-Link DIR-619L B1 2.06. It has…8.8
• CVE-2024-9784A vulnerability classified as critical has been found in D-L…8.8