Portfolio Filter Gallery CVE-2026-105977

Requires an authenticated WordPress account with the Contributor role or higher on a site running Portfolio Filter Gallery 2.0.2 through before 2.2.1; exploitation targets the plugin's media-attachment deletion handler, which lacks a per-object ownership check. No special plugin configuration is needed and it works against default installs, but exploitation is limited by the need for a valid Contributor+ account (relevant on multi-author or open-registration sites) and the impact is confined to deleting attachments owned by other users - it does not yield code execution or data disclosure.

This is a low-priority, defense-in-depth issue despite being network-reachable. The signals are consistent in pointing to minor real-world risk: the vendor CVSS of 2.2 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) reflects authenticated, limited-integrity impact only, and no EPSS score, no CISA KEV listing, and no public POC were provided - exploitation status is therefore 'no public exploit identified at time of analysis'. The key internal conflict is in the privilege metric: the vendor vector sets PR:H, but the description explicitly states the flaw is reachable by the Contributor role 'and above', which is a low-privilege role - this argues for PR:L rather than PR:H and suggests the real attack surface is slightly larger than the 2.2 score implies. Even corrected, impact is bounded to unauthorized deletion of other users' media attachments (an integrity/data-loss issue, not code execution, data theft, or site takeover). The realistic risk is an insider or a compromised/registered contributor-level account destroying content belonging to others, including administrators - a nuisance and integrity concern on multi-author sites, not a mass-exploitation threat. Net: a genuine but low-severity broken-access-control bug, not a patch-tonight emergency.

On a multi-author WordPress site running Portfolio Filter Gallery between 2.0.2 and 2.2.1, an attacker who holds (or registers/obtains) a Contributor-level account invokes the plugin's attachment-deletion function and supplies the ID of a media file owned by another user. Because the plugin performs no per-object authorization check, the request succeeds and permanently deletes an administrator's or other author's attachment. No public exploit code was identified at time of analysis, and the high attack complexity plus required authentication limit practical abuse.