Final Tiles Grid CVE-2026-27424

The target WordPress site must have the Image Photo Gallery Final Tiles Grid plugin installed, active, and running version 3.6.11 or earlier. The attacker must hold at least a low-privileged authenticated WordPress account (PR:L per CVSS vector), such as a subscriber or contributor role - unauthenticated exploitation is not supported by the available CVSS data. No non-default configuration is required beyond having the plugin active. Exploitation is limited by the authentication prerequisite (reduces opportunistic/automated mass exploitation), the unchanged scope (S:U, no lateral movement to other site components), and the confidentiality-only impact (C:L, no write or denial-of-service capability confirmed). Sites that disable open user registration and have no untrusted authenticated users are not realistically at risk.

The CVSS base score of 4.3 (Medium) reflects a constrained real-world impact: the attack vector is network-accessible (AV:N) with low complexity (AC:L), but requires a low-privileged authenticated account (PR:L), limiting opportunistic mass exploitation. Scope is unchanged (S:U) and impact is limited to partial confidentiality exposure (C:L) with no integrity or availability impact (I:N/A:N). No EPSS score was provided in the available data, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog and no publicly available exploit code was identified at time of analysis. The Patchstack 'Authentication Bypass' tag suggests the access control bypass may allow a subscriber-level or contributor-level WordPress user to reach functionality intended for editors or administrators. In practice, risk is highest on sites where untrusted authenticated users exist (e.g., membership sites, WooCommerce stores, multisite installs). For single-admin sites, exploitability is further constrained by the limited pool of authenticated users.

An attacker registers or obtains a low-privilege WordPress account (e.g., subscriber) on a target site running Image Photo Gallery Final Tiles Grid 3.6.11 or earlier. The attacker sends a crafted authenticated HTTP request to the plugin's unprotected endpoint - such as an admin-ajax.php action or REST route - that bypasses the missing capability check, gaining read access to gallery data or plugin settings normally restricted to higher-privileged roles. No public exploit code was identified at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction make manual exploitation straightforward for any attacker familiar with WordPress plugin authorization patterns.