CVE-2024-0221 is a critical (CVSS 9.1) directory traversal flaw in the Photo Gallery by 10Web plugin for WordPress, in all versions up to and including 1.8.19. An authenticated user can rename arbitrary files, which can lead to site takeover. Update to a version newer than 1.8.19.
What's affected
The record says all versions up to and including 1.8.19 are affected, through the rename_item function in the plugin's file manager. By default only administrators can reach it. In the premium version, administrators can give gallery management permissions to lower level users, so it might be reachable by users as low as contributors.
The record does not name the fixed version, and our fetch of the Wordfence entry returned no content. The record does reference a plugin changeset on the WordPress plugin repository that follows the vulnerable code. Treat any release newer than 1.8.19 as the fix candidate and confirm the version number on the plugin page.
How to check if you're exposed
Check the plugin version from the WordPress admin under Plugins, or from the command line with WP-CLI on the server:
wp plugin get photo-gallery --fields=name,version,status
Run it per site if you manage many. On agencies and hosting providers, loop over every install, because the plugin is popular and often left active. If you manage sites through a dashboard, filter the plugin list for photo-gallery and sort by version.
Then check who can reach the gallery manager. In the free version only administrators can use it by default. If you run the premium version, review which roles have gallery management permissions, since lower privileged roles widen the exposure.
The free in-browser scan at https://gold.safeguard.sh/scan is meant for dependency manifests, so for WordPress the plugin list is the primary check.
What to do now
- List every WordPress site that has the photo-gallery plugin and record its version.
- Update the plugin to a release newer than 1.8.19 and confirm the version afterwards.
- On premium installs, review which roles hold gallery management permissions and remove them from untrusted users.
- Review the administrator and contributor accounts on affected sites and remove any you do not recognise.
- Check that wp-config.php is still present and unchanged on any site that ran a vulnerable version with untrusted users.
Why it matters
The weakness is CWE-22, path traversal. The record says the rename_item function does not restrict the paths it accepts, so an authenticated user can rename arbitrary files on the server. The record explains the worst case: renaming wp-config.php can lead to site takeover, because WordPress then falls back to its install flow.
The score is critical (9.1) mostly because the scope changes and the impact on confidentiality, integrity and availability is high, but the privilege requirement is high (PR:H) in the vector, which matches the default of administrator access only. The practical risk climbs on premium installs where permissions were delegated to lower users. This is a useful reminder that plugin permission settings change how severe a bug really is.
The record's KEV flag is false and we found no statement of exploitation.
Quick check
Can an anonymous visitor exploit CVE-2024-0221?
No. The record says it requires authentication. By default only administrators can reach the function.
What is the fixed version?
The record gives no fixed number, only that versions through 1.8.19 are affected. Check the plugin page for the current release.
Sources
- Wordfence vulnerability entry (returned no content when fetched, listed in the record)
- Plugin source reference listed in the record
- Gold entry for CVE-2024-0221
Last reviewed: 19 October 2026.
