What is the CVSS score of CVE-2026-57696?

CVE-2026-57696 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of Picture Gallery are affected by CVE-2026-57696?

VideoWhisper Picture Gallery plugin versions 1.6.5 and earlier allow authenticated contributors to delete arbitrary files from WordPress sites, including critical configuration files that could…

How to fix or mitigate CVE-2026-57696?

Within 24 hours, identify all WordPress installations running VideoWhisper Picture Gallery 1.6.5 or earlier and audit active Contributor role users to assess blast radius. Within 7 days, revoke unnecessary Contributor permissions, implement file integrity monitoring with alerts on critical WordPress files (wp-config.php, wp-settings.php, .htaccess), and disable the plugin until patched. Within 30 days, either remove the plugin entirely or upgrade to a patched version once available, validate all integrity monitoring alerts retroactively, and restrict Contributor access to essential trusted users only.

Picture Gallery CVE-2026-57696

EUVD-2026-48171 HIGH

Path Traversal (CWE-22)

2026-07-23 Patchstack

GHSA-f228-xcr3-mqw3

WordPress Path Traversal Picture Gallery Wordpress Plugin Videowhisper

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

7.1 HIGH

Network-reachable plugin action needing a Contributor account (PR:L), low complexity; arbitrary deletion yields high availability and limited integrity impact with no data disclosure (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:19 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.

AnalysisAI

Arbitrary file deletion in the VideoWhisper Picture Gallery WordPress plugin (versions <= 1.6.5) allows an authenticated user holding the low-privilege Contributor role to delete arbitrary files on the server via path traversal (CWE-22). Rated CVSS 7.1, the flaw carries no confidentiality impact but high availability impact, since deleting critical files (e.g. wp-config.php) can break or hijack the site. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the Picture Gallery plugin (CPE cpe:2.3:a:videowhisper:picture_gallery) developed by VideoWhisper for the WordPress CMS. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): a file-handling routine - typically a delete or image-management action exposed to the WordPress dashboard - accepts an attacker-controlled path parameter without properly canonicalizing or constraining it to an intended directory. By injecting traversal sequences (e.g. ../../), a Contributor can escape the plugin's upload/gallery directory and target files elsewhere in the WordPress filesystem. WordPress's Contributor role normally can author but not publish posts and has no file-management rights, so the vulnerability represents a privilege boundary bypass at the plugin level.

RemediationAI

No vendor-released patched version was identified in the provided data (the record only confirms versions <= 1.6.5 are vulnerable), so consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/picture-gallery/vulnerability/wordpress-picture-gallery-plugin-1-6-5-arbitrary-file-deletion-vulnerability for the current fixed release and upgrade to it as the primary remediation. Until a confirmed patch is applied, reduce exposure by restricting who holds the Contributor role - audit and remove untrusted Contributor accounts and disable open user registration or downgrade the default new-user role, which prevents attackers from obtaining the required privilege at the cost of limiting legitimate self-service authoring. Where feasible, deactivate the Picture Gallery plugin entirely (trade-off: gallery functionality is lost) and enforce least-privilege filesystem permissions plus off-site backups so an arbitrary deletion cannot be leveraged into full site takeover and can be recovered quickly.