EUVD-2026-83666
GHSA-xcq4-7q66-rcp3
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable but needs the delegated gallery-management capability (PR:L); missing check is deterministic (AC:L, disputing vendor AC:H); integrity-only site-wide setting change so I:L, C/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
AnalysisAI
Authenticated WordPress users who hold only the gallery-management capability of the plugin Photo Gallery, Sliders, Proofing and Themes can save site-wide image-sizing settings they are not entitled to change, because versions before 4.5.0 omit a capability check before writing those options. Only sites running the plugin at a version below 4.5.0 are affected, and the attacker must already have been granted the delegated gallery-management role by an administrator - this is a privilege-boundary erosion between two internal roles, not an unauthenticated compromise, and the impact is limited to the integrity of image-sizing configuration (no data disclosure, no availability loss). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress user who has been explicitly granted the plugin's gallery-management capability by an administrator; that user can then save image sizing settings even though they lack the plugin's options capability, and the changes apply site-wide. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-risk authorization flaw, and every signal agrees. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the Photo Gallery, Sliders, Proofing and Themes plugin to version 4.5.0 or later, which is the fixed release cited in the EUVD advisory; this is the only complete fix and should be applied through the normal WordPress plugin update flow. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file write - escalating to remote code execution on hosts that execute PHP from upload directories - affects t
Improper authorization in the WordPress plugin Photo Gallery, Sliders, Proofing and Themes before version 4.5.0 lets a u
Authenticated users who have been granted the plugin's gallery-management capability can overwrite the stored settings o
Missing object-level authorization in the Photo Gallery, Sliders, Proofing and Themes WordPress plugin before 4.5.0 allo
Share
External POC / Exploit Code
Leaving vuln.today