Photo Gallery CVE-2026-81653

Requires an authenticated WordPress account that an administrator has explicitly granted the plugin's gallery-management capability (PR:L insider) - anonymous visitors cannot exploit it. Exploitation is limited to sites running Photo Gallery, Sliders, Proofing and Themes before 4.5.0 that have multiple gallery-owning users (single-owner sites have nothing to cross into). The attacker must know or enumerate image IDs belonging to other users' galleries; no user interaction is needed. Impact is confined to deleting, copying, and re-tagging images - there is no code execution or broader site compromise.

This is a genuine but low-severity authorization flaw, not a high-priority emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2) already reflects modest risk: exploitation requires an authenticated account (PR:L) that an administrator has explicitly granted the plugin's gallery-management capability, so the attacker is a semi-trusted insider rather than an anonymous internet user. No EPSS score or CISA KEV entry is provided; there is no evidence of active exploitation, so the exploitation status is: publicly available exploit code exists (WPScan) but not confirmed exploited in the wild. The vendor's AC:H is debatable - image identifiers in WordPress galleries are typically sequential integers, making cross-gallery targeting straightforward, so real-world attack complexity is arguably lower (AC:L). Conversely the vendor scored A:N despite the description explicitly allowing image DELETION, which is an availability impact; I would rate A:L. Net: a real, POC-backed broken-access-control bug worth patching in multi-author photography sites, but the trust prerequisite and limited technical impact keep it well below urgent status.

On a multi-author WordPress site, an administrator grants a contributing photographer the plugin's gallery-management capability so they can curate their own galleries. That user then enumerates image IDs belonging to other photographers' galleries and issues delete, copy, or re-tag actions against them - destroying or exfiltrating (via copy into their own gallery) another user's images. Public exploit detail is available from WPScan.