CVE-2024-13814

Estado: AnalizadaAlta (8.8)—

The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 9.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.53%
Percentil entre todas las CVEs puntuadas: 43
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement75 %
Impacto principalT1059 Command and Scripting Interpreterexecution85 %
Impacto secundarioT1565 Data Manipulationimpact65 %

Acceso de red con privilegios (PR:L, Subscriber), ejecución de código mediante shortcodes no validados (CWE-94). do_shortcode permite ejecutar comandos WordPress/PHP y potencialmente modificar contenido del sitio.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Network Segmentation Disable or Remove Feature or Program Vulnerability Scanning Threat Intelligence Program Restrict Web-Based Content

Tecnologías afectadas (1)

Lcweb — Global Gallery

CWE

CWE-94

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-13814",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-13814",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-12T14:56:14.447738Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@wordfence.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@wordfence.com",
      "affectedData": [
        {
          "vendor": "LCweb",
          "product": "Global Gallery - WordPress Responsive Gallery",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "9.1.5"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-12T09:15:08.433",
  "references": [
    {
      "url": "https://codecanyon.net/item/global-gallery-wordpress-responsive-gallery/3310108",
      "tags": [
        "Product"
      ],
      "source": "security@wordfence.com"
    },
    {
      "url": "https://lcweb.it/global-gallery-wordpress-photogallery-plugin/changelog/",
      "tags": [
        "Release Notes"
      ],
      "source": "security@wordfence.com"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b5ba815-ce92-4d7b-aa80-29d6fddd7f63?source=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@wordfence.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@wordfence.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 9.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes."
    },
    {
      "lang": "es",
      "value": "El complemento The Global Gallery - WordPress Responsive Gallery para WordPress es vulnerable a la ejecución de códigos cortos arbitrarios en todas las versiones hasta 9.1.5 incluida. Esto se debe a que el software permite a los usuarios ejecutar una acción que no valida correctamente un valor antes de ejecutar do_shortcode. Esto hace posible que los atacantes autenticados, con acceso de nivel de suscriptor y superior, ejecuten códigos cortos arbitrarios."
    }
  ],
  "lastModified": "2026-06-17T07:02:46.580",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lcweb:global_gallery:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3BFE119-1ED2-4EA6-9037-F7781057314E",
              "versionEndExcluding": "9.1.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@wordfence.com"
}