EUVD-2026-82682
GHSA-hrf4-x4j2-f44x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged WP user
-
ExploitSend AJAX request omitting nonce field
-
ExecutionBypass missing capability/nonce check
-
ImpactOverwrite arbitrary post content / delete gallery options
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged WordPress account (PR:L) on a site running Filter Gallery versions 1.1.2 through before 1.1.5, and the attacker must call the affected AJAX handlers with the nonce field omitted - the handlers skip nonce verification in that case and perform no capability check. No user interaction and no admin privileges are needed, but the target site must actually have this specific plugin installed and activated, which is the main limiting factor. Because the flaw hinges on omitting the nonce, it can also be reached via cross-site request forgery against a logged-in user. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 7.1) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with high integrity impact (overwrite arbitrary post content) and low availability impact (deletion of the plugin's stored gallery options), and no confidentiality impact. A public exploit exists (WPScan) and a vendor patch is available in 1.1.5, but there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals. Note the vector states PR:L (an authenticated low-privileged account), yet the root cause is a missing nonce check when the nonce field is omitted, which also implies a CSRF/forgery angle against any logged-in user; this is a mild internal tension worth verifying against the WPScan advisory. Realistic priority is moderate for sites running this plugin because exploitation is easy and any subscriber-level account can corrupt content, but the niche footprint limits mass-exploitation risk. |
| Exploit ScenarioDerived | A user with a low-privileged WordPress account (e.g. subscriber) on a site running Filter Gallery < 1.1.5 sends a crafted AJAX request to a vulnerable handler while omitting the nonce field; because the handler neither verifies the nonce nor checks capabilities, the request overwrites the content of arbitrary posts and can delete the plugin's stored gallery options. A public proof-of-concept is available via WPScan, lowering the effort required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Authenticated low-privileged WordPress users can overwrite the content of arbitrary posts and wipe the Filter Gallery plugin's stored gallery options on sites running Filter Gallery versions 1.1.2 through before 1.1.5. The plugin's AJAX handlers skip nonce verification when the nonce field is omitted and perform no capability check, so any logged-in account - including subscribers - can invoke privileged actions over the network without user interaction. Publicly available exploit code exists and the WPScan entry documents the attack path, though there is no confirmation of active exploitation (CISA KEV); EPSS data was not provided. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 7.1) and our independent assessment agree on high integrity impact and low availability impact with no confidentiality loss.
RemediationAI
Vendor-released patch: upgrade Filter Gallery to version 1.1.5 or later - that is the first version in which the AJAX handlers properly enforce nonce verification and capability checks, and it is the only complete fix. Because the vulnerability requires an authenticated account, a temporary compensating control is to audit and, where feasible, tighten the site's user roles so that untrusted or self-registered accounts (subscribers, contributors) cannot authenticate at all - with the trade-off that this disrupts any legitimate low-privilege workflow and does not protect against CSRF against an administrator who is already logged in. Operators who cannot patch immediately should deactivate the plugin until they can update; this removes the exposed handler entirely but takes the gallery feature offline and may orphan stored gallery options. A WAF rule blocking POSTs to admin-ajax.php with the plugin's action parameters and no nonce field can blunt the omitted-nonce path, but such rules are brittle, risk breaking legitimate plugin functionality, and should be treated as temporary. After upgrading, review posts for unauthorized content modification and verify the plugin's stored gallery options are intact, since the flaw grants high integrity impact (arbitrary post overwrite) and low availability impact (deletion of gallery options). Reference the WPScan advisory at https://wpscan.com/vulnerability/39321ecd-98e5-4f4e-9a42-bedf5904c3d1/ and the VulDB entry at https://vuldb.com/vuln/407366 for patch confirmation and version details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an improper access control weakness (CWE-284) in the WordPress plugin Filter Gallery, affecting the AJAX handlers registered for its administrative/gallery operations. WordPress AJAX endpoints (admin-ajax.php) rely on two independent guards: a nonce (wp_verify_nonce / check_ajax_referer) to prove the request originates from a legitimate, user-initiated form, and a capability check (current_user_can) to prove the caller is authorized. In affected versions the plugin performs the nonce check only conditionally - if the nonce parameter is omitted entirely, the verification is skipped - and applies no capability check afterward. That means a request that simply leaves the nonce field out bypasses the CSRF/integrity control, and because no capability gate exists, the handler executes with the privileges of any authenticated session rather than requiring an editor or administrator. The handlers in scope permit arbitrary post content overwrite and deletion of the plugin's stored gallery options. The CPE record (cpe:2.3:a:unknown:filter_gallery:*) is not fully populated with a vendor identifier, so the authoritative version mapping comes from EUVD's range "Filter Gallery 1.1.2 <1.1.5"; installations at 1.1.5 or later contain the fix. The conditional-nonce pattern is significant beyond direct authenticated abuse: because the handler also fails to validate request origin, an attacker can craft a cross-site request forgery that triggers it in the browser context of any logged-in user, potentially including an administrator who visits a malicious page, since omitting the nonce field removes the only anti-CSRF defense.
Know when Filter Gallery gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Any low-privileged authenticated user (PR:L) can remotely (AV:N) and easily (AC:L) overwrite arbitrary post content (I:H) and delete gallery options (A:L); no data is read (C:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin before 1.1.5's stored gallery options.
Technical POC Analysis
Evidence base: the WPScan vulnerability entry (WPVDB 39321ecd-98e5-4f4e-9a42-bedf5904c3d1).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Filter Gallery plugin for WordPress, in versions 1.1.2 through before 1.1.5, permits any authenticated user - including the lowest-privilege subscriber accounts that many sites allow visitors to self-register - to overwrite the content of arbitrary posts and wipe the plugin's stored gallery settings. The exposure is one of content integrity and brand trust rather than data theft: no confidentiality loss or site takeover is indicated, but defaced or altered pages can damage customer confidence and, on regulated sites, create compliance and disclosure obligations. Because a subscriber account is often trivial to obtain, leadership should treat this as a realistic and easily triggered risk to public-facing content.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Filter Gallery
View allAn authorization bypass in the Filter Gallery WordPress plugin (farazfrank:filter_gallery) affects all versions up to an
Authorization bypass in the Filter Gallery plugin for WordPress (versions up to and including 1.1.4) lets any authentica
Exploit-DB