The Robo Gallery – Photo & Image Slider plugin for WordPress versions up to 3.2.19 contains a CSRF vulnerability (CWE-352) due to missing or incorrect nonce validation in the 'rbs_ajax_create_article' and 'rbs_ajax_reset_views' AJAX functions. This flaw enables unauthenticated attackers to perform unauthorized actions by leveraging the privileges of a logged-in user with Contributor or higher roles who is tricked into clicking a malicious link. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers to create new posts and reset gallery view counts without proper authorization, impacting the integrity and availability of the affected WordPress site. The attacker must trick a user with Contributor or higher privileges into performing an action, which involves user interaction. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should limit Contributor+ user interactions with untrusted content and consider disabling or restricting the use of the vulnerable plugin. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.