EUVD-2026-83664
GHSA-f6f9-8ghp-5wg5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Network-reachable endpoint, low complexity, requires only a low-privilege Contributor account (PR:L, not vendor's PR:H); leaks low-sensitivity image metadata so C:L, I:N, A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.
AnalysisAI
Missing object-level authorization in the Photo Gallery, Sliders, Proofing and Themes WordPress plugin before 4.5.0 allows authenticated users with the Contributor role or higher to read the stored metadata of any image on the site, including images that belong to other users' galleries; publicly available exploit code exists. Exploitation requires an authenticated Contributor+ account on a site running an affected version (3.59.5 through 4.5.0), needs no user interaction or special configuration, and is impossible for anonymous visitors, which caps the practical impact at low confidentiality loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account with the Contributor role or higher on the target site (typically a multi-author / photographer-client site running the Photo Gallery, Sliders, Proofing and Themes plugin at a version between 3.59.5 and 4.5.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-severity information-disclosure flaw (CWE-639, insecure direct object reference / broken object-level authorization) whose real-world priority is minor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 4.5.0 - upgrade the Photo Gallery, Sliders, Proofing and Themes WordPress plugin to 4.5.0 or later, which is the fix version implied by the affected range recorded in ENISA EUVD (3.59.5 < 4.5.0); update through the WordPress plugin dashboard or WP-CLI ('wp plugin update') and confirm the installed version afterwards, then review the WPScan advisory at https://wpscan.com/vulnerability/58759289-adca-47d5-8c15-c073c9f14c31/ for any vendor notes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file write - escalating to remote code execution on hosts that execute PHP from upload directories - affects t
Improper authorization in the WordPress plugin Photo Gallery, Sliders, Proofing and Themes before version 4.5.0 lets a u
Authenticated WordPress users who hold only the gallery-management capability of the plugin Photo Gallery, Sliders, Proo
Authenticated users who have been granted the plugin's gallery-management capability can overwrite the stored settings o
Share
External POC / Exploit Code
Leaving vuln.today