WordPress Filter Gallery Plugin Nonce and Capability Bypass

The Filter Gallery WordPress plugin before version 1.1.5 contains a critical authorization vulnerability in its AJAX handlers. When a nonce field is omitted from requests, the plugin fails to verify the nonce token and does not check user capabilities, allowing low-privileged users (including subscribers or unauthenticated users depending on WordPress configuration) to perform privileged actions. This vulnerability enables attackers to arbitrarily overwrite the content of any post and delete stored gallery options, potentially leading to data destruction, website defacement, and loss of gallery configurations. WordPress sites relying on this plugin for image gallery functionality are directly at risk, particularly those with numerous contributors or public-facing content.

While this CVE maps to CWE-284 (Improper Access Control), it reflects attack patterns consistent with MITRE ATT&CK techniques like T1190 (Exploit Public-Facing Application) and T1190-derived post-exploitation activities. Casky.ai's extended reasoning capabilities across 754 security skills would detect this vulnerability by identifying suspicious AJAX request patterns that lack proper nonce validation, abnormal post modification requests from low-privilege accounts, and unauthorized capability execution in WordPress logs. A practitioner using Casky would surface findings indicating repeated failed nonce checks, capability bypass attempts in AJAX handlers, and bulk content modifications originating from unexpected user roles—patterns that indicate exploitation of authorization controls before they escalate to active compromise.