The Robo Gallery – Photo & Image Slider plugin for WordPress contains a missing authorization (CWE-862) vulnerability in the ajaxGetGalleryJson() function. This flaw allows authenticated users with subscriber-level privileges or higher to bypass intended access controls and retrieve private post titles. The vulnerability affects all versions up to 3.2.21. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low complexity, requiring privileges, no user interaction, and limited confidentiality impact. No patch or vendor advisory indicating remediation is currently available.

Authenticated users with subscriber-level access or higher can retrieve private post titles that should be restricted. This exposure of private information could lead to information disclosure but does not affect data integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and monitor for plugin updates from the vendor. Avoid granting unnecessary privileges to users to limit exposure.