A critical vulnerability in the WP AUDIO GALLERY plugin allows authenticated users to read arbitrary files and modify server configuration, posing a significant risk to site integrity.

This vulnerability is caused by missing capability checks and lack of nonce verification within the wpag_htaccess_callback function. It allows authenticated attackers with subscriber-level access or higher to perform unauthorized actions, including the overwriting of the server .htaccess file.

The ability to perform arbitrary file reads and modify the .htaccess file provides an attacker with a path to full site compromise. An adversary could potentially exfiltrate sensitive configuration files, inject malicious redirects, or disable security restrictions, leading to total loss of confidentiality and integrity. With a CVSS score of 8.8, this flaw represents a high-severity threat that should be addressed immediately.

Immediate Action: There is currently no patched version available for this plugin. Administrators should immediately deactivate and remove the WP AUDIO GALLERY plugin until a secure update is released by the developer.

Proactive Monitoring: Monitor server access logs for unusual requests directed at the .htaccess file or attempts to access restricted system files. Review user activity logs for suspicious actions performed by accounts with subscriber-level privileges.

Compensating Controls: If the plugin must remain active, ensure a Web Application Firewall is configured to block unauthorized requests to the vulnerable callback function and restrict access to the .htaccess file at the server level.

Public Exploit Available: Unknown.

Given the lack of a vendor-provided patch, the only effective way to mitigate this vulnerability is the complete removal of the affected software. Organizations relying on WP AUDIO GALLERY should prioritize the identification of alternative solutions and remove the plugin from their WordPress environments to prevent potential exploitation by authenticated users.