The Photo Gallery by Ays – Responsive Image Gallery WordPress plugin suffers from a CSRF vulnerability due to the lack of nonce verification in the 'process_bulk_action()' function. This flaw affects all versions up to and including 6.4.8. An attacker can exploit this by crafting a forged request that, if an administrator is tricked into interacting with it, can perform bulk actions like deleting, publishing, or unpublishing galleries without proper authorization. The vulnerability is identified as CWE-352 and has a CVSS 3.1 base score of 4.3, indicating medium severity. There is no information about an available patch or vendor advisory at this time.

The vulnerability allows unauthorized bulk operations on galleries within the plugin by exploiting CSRF, potentially leading to unintended deletion or modification of gallery content. There is no direct confidentiality or availability impact reported. The attack requires tricking an administrator into performing an action, such as clicking a malicious link, to succeed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with unsolicited links and consider limiting administrative access or implementing additional CSRF protections at the web server or application level.