EUVD-2026-83663
GHSA-w7wf-gqrx-wh54
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Remote authed user with a delegated gallery-management capability (PR:L) and no ownership check overwrites another gallery's settings; integrity-only (I:L), no confidentiality or availability impact, AC:H for the capability grant plus target-ID knowledge.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
7DescriptionCVE.org
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users.
AnalysisAI
Authenticated users who have been granted the plugin's gallery-management capability can overwrite the stored settings of any gallery on a WordPress site running the 'Photo Gallery, Sliders, Proofing and Themes' plugin before 4.5.0, including galleries belonging to other users and each gallery's stored filesystem path, because the save routine never checks that the submitted gallery ID belongs to the requesting account (CWE-639, IDOR). Impact is integrity-only and rated Low (CVSS 3.1); the flaw is not reported as actively exploited, but publicly available exploit code exists, and the vendor has released 4.5.0 to correct it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an administrator has explicitly granted the attacker's account the plugin's gallery-management capability (PR:L) - an unprivileged subscriber or anonymous visitor cannot trigger it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but LOW-priority authorization flaw (CWE-639, IDOR). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix by updating the 'Photo Gallery, Sliders, Proofing and Themes' plugin to 4.5.0 or later - the vendor-released patch closes the missing ownership check in the gallery save routine, and this is the only complete resolution; confirm the installed version through the WordPress Plugins screen and verify the update actually applied. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today