Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-9445: Unite Gallery Lite can let attackers alter site data

CVE-2015-9445 · published 7 years ago

Summary

The Unite Gallery Lite plugin for WordPress (versions before 1.5) is vulnerable to attacks that can trick a logged‑in administrator into running unwanted actions and can let an attacker inject malicious commands into the database. This could allow changes to site content or other sensitive information. Update the plugin to version 1.5 or later and ensure only trusted users have administrator access.

What to do

Update unitegallery unite_gallery_lite to version 1.5 or later.

Affected software

Vendor	Product	Affected versions
unitegallery	unite_gallery_lite	< 1.5 `cpe:2.3:a:unitegallery:unite_gallery_lite::::::wordpress::*`

Original advisory text

The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.

References

http://packetstormsecurity.com/files/132842/ Exploit Third Party Advisory VDB Entry
https://wordpress.org/plugins/unite-gallery-lite/#developers Product Release Notes
https://wpvulndb.com/vulnerabilities/8113 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published26 Sep 2019

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2015-9445 · NVD

Track software like this

Free during beta