Portfolio Filter Gallery CVE-2026-105976

Requires the Portfolio Filter Gallery plugin at a version before 2.2.1 to be installed and active, AND the attacker must hold at least a Contributor-role account on the target WordPress site; the attacker then directly calls the affected AJAX actions, which omit authorization checks. The key limiting factor is the account requirement: sites that do not permit untrusted users to obtain Contributor (or higher) access are not exploitable by anonymous attackers, so risk is concentrated on multi-author or open-registration sites. No user interaction by a victim is needed.

This is a moderate, real-but-not-urgent issue. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L, base 4.7) indicates network-reachable, low-complexity exploitation with no user interaction but requiring privileges. There is a notable conflict between the vector and the description: the vector encodes PR:H (high privileges), yet the description states exploitation requires only a Contributor-level account, which in WordPress is a LOW-privilege authenticated role - this strongly suggests the metric should be PR:L, which would raise the real severity to roughly 6.3. The impact is uniformly Low across C/I/A because the attacker can only read, modify, and delete gallery objects and site-wide gallery filters, not the broader site or server. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from the input; exploitation status is therefore 'no public exploit identified at time of analysis.' Net: a legitimate broken-authorization (IDOR-style) flaw worth patching, but its practical risk is gated by whether the site grants Contributor accounts to untrusted users - verify the PR metric with WPScan/vendor before using the 4.7 score for prioritization.

On a multi-author WordPress site running Portfolio Filter Gallery before 2.2.1, an attacker who holds (or registers for) a Contributor account directly invokes the plugin's unprotected AJAX actions. Because authorization is not checked, they read, alter, or delete galleries belonging to other authors and manipulate site-wide gallery filters, defacing or disrupting portfolio content. No public exploit code was identified at the time of analysis, and no user interaction is required once the attacker is authenticated.