Photo Gallery CVE-2026-81650

Exploitation requires an authenticated WordPress account that an administrator has explicitly granted the plugin's gallery-management capability (PR:H) - this is not a default subscriber or unauthenticated path. The attacker must submit an archive to the plugin's upload/extraction feature; the extension-validation bypass then allows a PHP file to land in a web-accessible gallery directory. Full remote code execution additionally requires that the hosting environment actually executes PHP in that upload directory (the description limits RCE to 'hosts that execute them'); on hardened hosts that block script execution in upload paths, the impact is reduced to arbitrary file write. No user interaction is needed (UI:N).

This is a genuine mid-to-high priority finding for sites running the affected plugin, but its severity is meaningfully gated by privilege. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2) accurately reflects that exploitation requires a privileged actor: the description states only users granted the plugin's gallery-management capability by an administrator can reach the vulnerable extraction code, which maps correctly to PR:H rather than PR:N. Signal alignment is good: a public exploit exists (WPScan) and a vendor patch (4.5.0) is available, so both the offensive and defensive halves are confirmed. However, this is a POC-availability signal, not active-exploitation - there is no CISA KEV listing and no EPSS score provided, so treat it as 'publicly available exploit code exists,' NOT weaponized/in-the-wild. The C:H/I:H/A:H impact is credible because the flaw yields arbitrary file write into a web-accessible directory and thus RCE, but note the description qualifies RCE as occurring only 'on hosts that execute them' - the write-primitive is universal, code execution depends on server config. Net: prioritize patching where the plugin is present and where semi-trusted gallery-manager roles are delegated, but the PR:H requirement makes mass, opportunistic exploitation unlikely.

An attacker who has been (or has phished/compromised) a non-admin account holding the plugin's gallery-management capability uploads a crafted archive whose entries carry PHP extensions; the reused loop-counter bug causes the extension whitelist check to always pass, so the malicious .php file is extracted into a web-accessible gallery directory. The attacker then requests that file over HTTP and, on a host configured to execute PHP in that path, achieves remote code execution. A public exploit for this technique is available via WPScan.