EUVD-2026-82726
GHSA-38vh-9c8v-rmgw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister subscriber account on target WordPress
-
ExploitAuthenticate and reach plugin action handler
-
ExecutionSend request lacking capability check
-
ImpactOverwrite arbitrary post content and ufg_gallery_* options
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with subscriber-level access or above (PR:L) on a site running Filter Gallery plugin version 1.1.4 or earlier; no user interaction and no special non-default configuration are needed beyond the plugin being installed and active. The practical prerequisite - an attacker-controlled low-privilege account - is trivially met on sites that permit open user registration, but is a real limiting factor on sites that disable self-registration. Impact is limited to integrity tampering (overwriting arbitrary post title/content, writing the _wp_attachment_image_alt meta key on arbitrary posts, and creating/overwriting arbitrary ufg_gallery_* options); there is no confidentiality or availability impact and no code execution. |
| Impact | This is a genuine but modest-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) is internally consistent with the description: network-reachable, low complexity, requires only subscriber-level authentication, no user interaction, and integrity-only impact (I:L) with no confidentiality or availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided - the only source is Wordfence threat intel plus the plugin's source and the fix changeset. There is no SSVC data supplied. The signals do not conflict; they consistently point to a low-priority, low-privilege data-integrity flaw rather than a high-impact remote code execution. The main real-world amplifier is that many WordPress sites allow open subscriber registration, which lowers the practical bar for the PR:L prerequisite; the main limiter is that impact is confined to tampering (overwriting post title/content, writing an alt-text meta key, and creating/overwriting ufg_gallery_* options) with no direct code execution or data exfiltration. Treat as routine-patch priority, not emergency. |
| Exploit ScenarioDerived | An attacker registers or obtains a subscriber-level account on a WordPress site running Filter Gallery <=1.1.4, then invokes the plugin's unprotected action handlers to overwrite the title and content of arbitrary published posts and to create or overwrite arbitrary ufg_gallery_* options. This enables defacement, content injection, or misconfiguration of site galleries. No public exploit code was identified at time of analysis, though the affected source lines and fix changeset are publicly viewable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Authorization bypass in the Filter Gallery plugin for WordPress (versions up to and including 1.1.4) lets any authenticated user with subscriber-level access or higher rewrite the title and content of arbitrary posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options. The flaw is a missing capability/nonce check in the plugin's AJAX-style handlers (CWE-862), so no user interaction and no non-default configuration are required beyond the plugin being installed and active; the practical prerequisite is a low-privilege account, which is trivial on sites with open registration but a real barrier where self-registration is disabled. Impact is integrity-only - no confidentiality or availability loss and no code execution - and no public exploit code has been identified at time of analysis.
RemediationAI
Upgrade the Filter Gallery plugin beyond version 1.1.4 to the first release that contains the vendor's authorization fixes - the fix has been committed in the WordPress plugin repository as changeset 3695415 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3695415%40filter-gallery&new=3695415%40filter-gallery), and because that reference is a repository changeset rather than a tagged release, the corresponding patched version number should be confirmed on the plugin's WordPress.org page or in the vendor advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/73577a0d-8aac-4369-8022-98c198f79224?source=cve) before treating an installation as remediated. If no patched build can be applied immediately, deactivate and, if unused, uninstall the plugin - the trade-off is loss of the filterable gallery functionality, which is preferable to leaving arbitrary post and option writes available. Because exploitation needs only a subscriber-level account, the most effective compensating control is to remove the attacker's entry point: disable open user self-registration in WordPress settings or gate it behind administrator approval (e.g., a membership plugin or email-verification workflow), and audit existing accounts for unauthorized subscriber-and-above users; the trade-off is friction for legitimate sign-ups and additional administrative overhead. Additionally, review wp_posts titles/content, the _wp_attachment_image_alt meta key, and the ufg_gallery_* rows in wp_options for unexpected changes, restore any altered content from a known-good backup, and consider short-term monitoring (e.g., revision history review or a file/DB change audit) to detect repeat tampering; note that this vulnerability cannot be fully mitigated by network-level controls such as WAF port blocking, since the malicious requests are ordinary authenticated WordPress traffic indistinguishable from legitimate plugin use.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Filter Gallery is a third-party WordPress plugin maintained by farazfrank, tracked by CPE cpe:2.3:a:farazfrank:filter_gallery:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization): the plugin exposes action handlers in filter-gallery.php (the advisory cites lines 843, 845, 884, 885 and 902) that accept attacker-supplied post IDs, post content, meta keys/values and option names, then call WordPress data-modifying APIs such as wp_update_post(), update_post_meta() and update_option() without verifying that the caller holds the capability required for that specific object or site-wide action. Because WordPress resolves the current user from the logged-in session before these handlers run, any account at subscriber level or above passes the only implicit gate, and the plugin's failure to apply current_user_can() checks and nonce validation lets that low-privilege user reach privileged functionality. The write primitives are generic rather than gallery-scoped: post title/content overwrites affect arbitrary post IDs, the _wp_attachment_image_alt meta key can be planted on any post, and the ufg_gallery_* option namespace can be created or overwritten, meaning manipulated settings can change how galleries render on the site. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N reflects network reachability, low attack complexity, a required low-privileged account, no user interaction, and limited integrity impact only.
Know when Filter Gallery gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable AJAX handler, low complexity, requires a subscriber account (PR:L), no interaction; impact is limited data tampering so I:L with C:N/A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary WordPress posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Filter Gallery
View allAn authorization bypass in the Filter Gallery WordPress plugin (farazfrank:filter_gallery) affects all versions up to an
Authenticated low-privileged WordPress users can overwrite the content of arbitrary posts and wipe the Filter Gallery pl
Exploit-DB