CVE-2023-6947

Description

The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, which can contain sensitive information such as folder structure.

CVSS v3.1 Score

7.7

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness Type (CWE)

CWE-25 CWE-25

CWE-22 Path Traversal

Affected Products

Vendor	Product	Versions
fooplugins	foogallery	< 2.4.27

References

Advisories & Patches

https://github.com/fooplugins/foogallery/pull/263/commits/9989f6f4f4d478ec04cb634d09b18c87a5b31c4d

Other References

https://www.wordfence.com/threat-intel/vulnerabilities/id/68420c5a-4add-4597-bd2a-20dc831e81bd?source=cve

Frequently Asked Questions

What is CVE-2023-6947? +

The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, which can contain sensitive information such as folder structure. It has a CVSS v3.1 base score of 7.7 (HIGH).

How severe is CVE-2023-6947? +

CVE-2023-6947 has a CVSS v3.1 score of 7.7 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2023-6947? +

CVE-2023-6947 affects products from fooplugins, specifically: foogallery. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-6947? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-68916 9.1

Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code execution.

CVE-2023-52076 8.5

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary …

CVE-2023-52138 8.2

Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability …

CVE-2023-6919 7.5

Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. VGuard allows Absolute Path Traversal.This issue affects VGuard: before …

CVE-2024-2442 7.5

Franklin Fueling System EVO 550 and EVO 5000 are vulnerable to a Path Traversal vulnerability that could allow an attacker …

CVE-2025-0225 4.3

A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is an …