The Filter Gallery WordPress plugin contains an improper access control vulnerability that allows low-privileged authenticated users to perform unauthorized modifications to post content and plugin settings.

This vulnerability involves a lack of nonce verification and missing capability checks within several AJAX handlers. An attacker with low-level authenticated access can exploit this to overwrite arbitrary post content and delete plugin gallery configurations.

The ability for unauthorized users to overwrite website content poses a significant risk to data integrity and brand reputation. With a CVSS score of 7.1, this high-severity flaw enables malicious actors to deface pages or disrupt site operations, directly impacting content availability and administrative control over the WordPress environment.

Immediate Action: Update the Filter Gallery WordPress plugin to version 1.1.5 or later immediately to apply the necessary capability checks and nonce validation.

Proactive Monitoring: Review web server access logs for anomalous AJAX requests targeting plugin-specific paths, particularly those originating from user accounts with minimal privileges.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized AJAX calls or restricted administrative actions performed by low-privileged user roles.

Public Exploit Available: Unknown

Given the potential for unauthorized content modification, administrators should prioritize updating the Filter Gallery plugin to version 1.1.5 without delay. Organizations should also audit current user roles and permissions to ensure that low-privileged accounts do not possess excessive capabilities that could be leveraged to facilitate such attacks.