Security readout for executives and security teams
Plain-English summary
This WordPress plugin flaw lets any logged-in user, including a basic subscriber, change arbitrary user metadata through insufficient access control. The source describes limited integrity impact because values are strings only. Business urgency depends on whether the plugin is installed and whether untrusted users can create or hold accounts.
Executive priority
Treat as a moderate-priority WordPress exposure. Prioritize sites with public registration, customer portals, or user metadata tied to permissions or business workflow. Patch or disable affected plugin installations after confirming vendor guidance.
Technical view
CVE-2023-3957 affects ACF Photo Gallery Field for WordPress through version 1.9. The apg_profile_update function lacked sufficient restriction, allowing authenticated Subscriber+ users to update arbitrary user meta as string values. CVSS 3.1 is 4.3: network reachable, low complexity, low privilege, no user interaction, low integrity impact.
Likely exposure
Exposure is likely limited to WordPress sites running ACF Photo Gallery Field version 1.9 or earlier, especially sites with open registration, customer accounts, memberships, or many low-privilege users. Sites without the plugin, without affected versions, or without untrusted authenticated users have lower exposure.
Exploitation context
The bundle does not show CISA KEV listing or cited active exploitation. Exploitation requires authentication at Subscriber level or above and targets user metadata modification, not direct confidentiality or availability impact. The business risk is higher where user meta drives permissions, workflow, personalization, or security decisions.
Researcher notes
Evidence supports an authenticated arbitrary usermeta update due to insufficient restriction in apg_profile_update. The source bundle does not establish privilege escalation, active exploitation, or a specific fixed version. Validate impact against local user-meta usage because practical severity depends on what metadata controls.
Mitigation direction
- Inventory WordPress sites for the ACF Photo Gallery Field plugin and version.
- Upgrade beyond version 1.9 if a vendor-approved fixed release is available.
- If no fix is available, disable the plugin until vendor guidance is clear.
- Restrict open registration and remove unnecessary low-privilege accounts.
- Review user-meta-dependent authorization or workflow decisions for unsafe trust assumptions.
Validation and detection
- Confirm whether navz-photo-gallery or ACF Photo Gallery Field is installed.
- Check installed plugin versions against the affected range: up to and including 1.9.
- Review user accounts with Subscriber or higher privileges for unnecessary access.
- Audit recent user metadata changes for unexpected fields or values.
- Confirm remediation against WordPress.org plugin changelog or vendor guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-3957 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/689511e0-1355-4fcb-8a72-d819abc8e9a3?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/navz-photo-gallery/tags/1.9/includes/acf_photo_gallery_save.php#L42CVE reference
- https://plugins.trac.wordpress.org/changeset/2943404/navz-photo-gallery#file0CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authorization
Improper Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.