WordPress NextGen Gallery plugin <= 3.4.7 - Cross-Site Request Forgery (CSRF) leading to XSS and RCE via file upload and LFI
Product
NextGEN Gallery
Description
Cross-Site Request Forgery (CSRF) leading to XSS and RCE via file upload and LFI found by WordFence in WordPress NextGen Gallery plugin (versions <= 3.4.7).
Solution
Update the WordPress NextGen Gallery plugin to the latest available version (at least 3.5.0).
Classification
Type Cross Site Request Forgery (CSRF) OWASP Top 10 A8: Cross Site Request Forgery (CSRF)