Supsystic Photo Gallery CVE-2026-102399

Exploitation requires an authenticated WordPress user with sufficient privileges (e.g., administrator or editor managing galleries) to be logged into a site running Photo Gallery by Supsystic <= 1.21.0, and to be socially engineered into visiting an attacker-controlled page while that session is active (UI:R). The attacker themselves needs no credentials (PR:N), but exploitation is fundamentally limited by the mandatory victim interaction and the requirement that the targeted action lacks CSRF nonce protection; impact is confined to low-integrity/low-availability state changes within the plugin, not the wider site or server.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, base 5.4) describes a network-borne, low-complexity CSRF requiring no attacker authentication (PR:N) but mandatory victim interaction (UI:R) - a trusted, authenticated WordPress user/administrator must be tricked into visiting an attacker-controlled page while logged in. Impact is limited to low integrity and low availability (I:L/A:L) with no confidentiality loss (C:N), consistent with a state-changing forged request rather than data theft or code execution. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The overwhelming reliance on social engineering of a privileged victim (UI:R) and the modest, non-CIA-critical impact place this firmly in the low-to-moderate real-world-risk band despite the network vector: it is a real but low-priority hardening issue, not a mass-exploitable flaw. There is no data conflict - the description ('Unauthenticated CSRF') aligns cleanly with PR:N/UI:R, where 'unauthenticated' refers to the attacker, not the victim.

An attacker crafts a malicious web page or email containing a hidden auto-submitting form that targets a state-changing action in the Photo Gallery by Supsystic plugin. When a logged-in WordPress administrator or editor visits the page, their browser silently submits the forged request using their valid session, altering plugin settings or gallery data. No public exploit code is currently identified, and success depends on catching an authenticated user who is simultaneously logged in.