Cyber Resilience

CVE-2024-13814

Medium

Published: 12 February 2025

Published
12 February 2025
Modified
18 February 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0035 58.0th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13814 is a medium-severity Code Injection (CWE-94) vulnerability in Lcweb Global Gallery. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-13814 is an arbitrary shortcode execution vulnerability in The Global Gallery - WordPress Responsive Gallery plugin for WordPress, affecting all versions up to and including 9.1.5. The issue stems from the plugin allowing execution of an action that fails to properly validate a value prior to invoking the do_shortcode function, enabling code injection as classified under CWE-94.

Authenticated attackers possessing Subscriber-level access or higher can exploit this vulnerability remotely with low attack complexity and no user interaction required. Exploitation permits execution of arbitrary shortcodes, potentially compromising low levels of confidentiality and integrity, as reflected in the CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Advisories and patch information are detailed in the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/4b5ba815-ce92-4d7b-aa80-29d6fddd7f63?source=cve, the plugin changelog at https://lcweb.it/global-gallery-wordpress-photogallery-plugin/changelog/, and the plugin's CodeCanyon page at https://codecanyon.net/item/global-gallery-wordpress-responsive-gallery/3310108.

EU & UK References

Vulnerability details

The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 9.1.5. This is due to the software allowing users to execute an action that does not…

more

properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.

CWE(s)
CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct remote exploitation of a public-facing WordPress plugin via unauthenticated shortcode/code injection (CWE-94) from subscriber-level accounts.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-13773Shared CWE-94
CVE-2025-50692Shared CWE-94
CVE-2026-30643Shared CWE-94
CVE-2026-30460Shared CWE-94
CVE-2025-71243Shared CWE-94
CVE-2026-44262Shared CWE-94
CVE-2024-13792Shared CWE-94
CVE-2020-37052Shared CWE-94
CVE-2026-42555Shared CWE-94
CVE-2025-65037Shared CWE-94

Affected Assets

lcweb
global gallery
≤ 9.1.6

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation of user-supplied inputs before processing with do_shortcode, directly preventing arbitrary shortcode execution due to improper validation.

SI-2 Flaw Remediation good match
prevent

Mandates timely flaw remediation including patching the vulnerable WordPress plugin versions up to 9.1.5, eliminating the code injection vulnerability.

AC-6 Least Privilege partial match
prevent

Enforces least privilege to restrict subscriber-level users from accessing or exploiting plugin actions that enable shortcode execution, limiting potential impact.

References