What is the CVSS score of CVE-2026-22485?

CVE-2026-22485 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of My Album Gallery are affected by CVE-2026-22485?

CVE-2026-22485 presents notable security risk, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-22485?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

My Album Gallery CVE-2026-22485

EUVD-2026-15491 MEDIUM

Missing Authorization (CWE-862)

2026-03-25 Patchstack

GHSA-pj75-vx8x-rmq9

Authentication Bypass My Album Gallery

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15491

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in Ruhul Amin My Album Gallery my-album-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Album Gallery: from n/a through <= 1.0.4.

AnalysisAI

Improper access control in My Album Gallery versions up to 1.0.4 enables authenticated users to modify gallery data they should not have permission to access. An attacker with valid credentials can exploit this misconfiguration to alter or manipulate album content without proper authorization checks.

Technical ContextAI

The vulnerability resides in the Ruhul Amin My Album Gallery WordPress plugin, identified via CPE cpe:2.3:a:ruhul_amin:my_album_gallery:*:*:*:*:*:*:*:*. The root cause is classified under CWE-862 (Missing Authorization), which describes situations where a software system fails to properly enforce access control restrictions before allowing users to access or modify resources. In WordPress plugin architecture, this typically occurs when capability checks (using functions like current_user_can()) are absent or improperly implemented in action hooks and AJAX handlers. The plugin fails to validate user permissions at critical control points, allowing unauthenticated or low-privilege users to execute administrative operations such as file deletion. This is a common class of vulnerability in WordPress plugins where developers neglect to implement proper nonce verification and role-based access control.

RemediationAI

Immediately deactivate and remove the My Album Gallery plugin from all affected WordPress installations until a patched version is available from the vendor or Ruhul Amin. Monitor the plugin's official repository and Patchstack for security updates to version 1.0.5 or later. If the gallery functionality is critical and the plugin is no longer maintained, evaluate alternative WordPress gallery plugins from actively maintained developers (such as Gutenberg Gallery, Elementor Gallery, or other established alternatives). As an interim mitigation, administrators can restrict direct access to the plugin's files via web server configuration (deny access to wp-content/plugins/my-album-gallery/) and implement file integrity monitoring to detect unauthorized file deletions. Additionally, enable WordPress security logging and review user activity logs for suspicious file operations.