Back
WordPress NextGen Gallery plugin <= 3.4.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to file upload
- Product
- NextGEN Gallery
- Description
- Cross-Site Request Forgery (CSRF) vulnerability leading to file upload found by WordFence in WordPress NextGen Gallery plugin (versions <= 3.4.7).
- Solution
- Update the WordPress NextGen Gallery plugin to the latest available version (at least 3.5.0)
- Classification
-
Type Cross Site Request Forgery (CSRF)
OWASP Top 10 A8: Cross Site Request Forgery (CSRF)
- References
-
Vulnerability details
Plugin changelog
- CVE
- Name CVE-2020-35943
- Versions
-
Affected In
<= 3.4.7
Fixed In 3.5.0
- Disclosure date
- 2021-02-08
- Credits
- WordFence