Photo Gallery CVE-2026-81651

Exploitation requires that an administrator has explicitly granted the attacker's account the plugin's gallery-management capability (PR:L) - an unprivileged subscriber or anonymous visitor cannot trigger it. The attacker must also target a gallery ID they do not own; the plugin performs no ownership verification on save. It affects the 'Photo Gallery, Sliders, Proofing and Themes' plugin at versions before 4.5.0. Limiting factors: the delegated capability is a meaningful gate (the actor is a semi-trusted, admin-provisioned user), impact is integrity-only (overwriting settings/filesystem path, no read or availability loss), and the AC:H rating reflects the need for capability grant plus knowledge of other galleries' IDs.

This is a genuine but LOW-priority authorization flaw (CWE-639, IDOR). The vendor CVSS 3.1 score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) is honest: it is integrity-only (C:N/A:N, I:L), requires authentication (PR:L), and carries AC:H because the attacker must first be granted the gallery-management capability by an administrator and must know/target galleries they do not own. Publicly available exploit code exists (WPScan), but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation - so the POC signal indicates disclosure maturity, not widespread weaponization. No SSVC data was provided. Note the input Tag 'Authentication Bypass' conflicts with the actual mechanism: PR:L in the CVSS vector and CWE-639 confirm this is a post-authentication broken-object-level-authorization issue (a trusted delegated user acting beyond their scope), NOT an authentication bypass - treat the tag as mislabeled. The real-world severity is bounded because the actor is already a semi-trusted user placed there by an admin; the meaningful escalation is overwriting another gallery's stored filesystem path, which could enable cross-user tampering or set up file-write abuse.

An administrator grants a low-trust user (e.g., a contributor or photographer) the plugin's gallery-management capability. That user issues a gallery-save request referencing a gallery ID they do not own, and because the plugin never checks ownership, they overwrite another user's gallery settings - including its stored filesystem path. Publicly available exploit code from WPScan demonstrates the request.