The MaxGalleria plugin for WordPress suffers from a missing authorization (CWE-862) vulnerability in the add_media_library_images_to_gallery function. This flaw allows any authenticated user with subscriber or higher privileges to upload arbitrary images to galleries, bypassing intended capability checks. The vulnerability affects all versions up to and including 6.4.2. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, required privileges at the level of a subscriber, no user interaction, and an impact limited to integrity (unauthorized image upload). No known exploits in the wild have been reported, and no patch or vendor advisory is currently available.

Authenticated users with subscriber or higher privileges can upload arbitrary images to galleries without proper authorization checks. This could allow unauthorized content insertion, potentially leading to content integrity issues on affected WordPress sites. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor user uploads closely. Consider disabling or limiting the use of the MaxGalleria plugin if unauthorized image uploads pose a significant risk in your environment.