Final Tiles Grid CVE-2026-104645

Requires an authenticated WordPress account with contributor-level role or above on a site running the Image Photo Gallery Final Tiles Grid plugin before 3.6.14; the vulnerable code paths are the plugin's gallery and image management actions (clone, modify, reorder, and metadata-write operations) where ownership is validated against a different object than the one acted on, or not validated at all. The principal limiting factor is the need for a contributor account: sites that do not provision contributor or higher roles to untrusted users are not realistically exposed. No special plugin configuration beyond having the plugin active is indicated, and no user interaction by the victim is required.

This is a genuinely low-priority issue despite being an authorization flaw. The input CVSS base score is 2.7 (Low) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - network-reachable and low-complexity, but gated behind privileges and limited to a low integrity impact (C:N/A:N). No EPSS score, no CISA KEV listing, and no public PoC were provided, so there is no signal of active or imminent exploitation; per precision rules this is 'no public exploit identified at time of analysis.' There is a notable internal conflict: the input vector encodes PR:H, but the description states exploitation requires only 'contributor-level access or above,' which is a LOW-privilege WordPress role, not a high/administrative one - this points to PR:L rather than PR:H and would raise the score modestly (see assessed vector). This is a classic IDOR/broken-object-authorization (CWE-639) affecting data integrity only: an attacker can tamper with other users' galleries and inject plugin metadata onto arbitrary posts, but cannot read confidential data or cause outages. Net: a real but low-severity multi-tenant integrity bug, relevant mainly to WordPress sites that grant untrusted users contributor accounts; not an urgent patch for single-author or tightly-controlled sites.

A site allows guest or external authors with contributor-level accounts. One such user sends crafted requests to the plugin's gallery/image management actions, referencing gallery, image, or post IDs owned by other users; because the plugin checks ownership against the wrong object or omits the check, the attacker clones, modifies, and reorders other users' galleries and writes plugin metadata onto posts they do not own. No public exploit code was identified at the time of analysis.