Image Photo Gallery Final Tiles Grid EUVD-2026-20177

Exploitation requires an authenticated WordPress administrator account (PR:H) with access to the WordPress admin dashboard and the plugin's gallery settings interface. The vulnerability exists specifically in the plugin's authorization logic for gallery or image settings modifications, likely triggered when an administrator submits forms or API requests to modify gallery configurations using user-controlled identifiers or parameters without server-side verification of ownership or permissions.

This vulnerability presents minimal real-world risk despite network accessibility. The CVSS score of 2.7 reflects the high-privilege requirement (PR:H), lack of confidentiality impact (C:N), and limited integrity impact (I:L). The EPSS score of 0.02% (4th percentile) indicates very low predicted exploitation probability in the wild. The attack requires an authenticated high-privilege user (administrator level), meaning only trusted WordPress site administrators with WP-Admin access can exploit this. The scope is unchanged (S:U), confining impact to the vulnerable component itself. This is best characterized as an administrative misconfiguration or multi-admin environment concern rather than a critical security priority for most deployments.

A high-privilege WordPress administrator on a multi-administrator site could craft requests with modified gallery identifiers or settings parameters to alter image gallery configurations that should be restricted to other administrators' galleries. For example, an admin could change visibility, ordering, or metadata of gallery items managed by another admin by manipulating the gallery ID or resource parameter in plugin settings forms, violating expected access boundaries between administrator accounts.