EUVD-2026-83664
GHSA-f6f9-8ghp-5wg5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor-level account
-
ExploitEnumerate/guess other users' image record IDs
-
ExecutionRequest image metadata via unverified read endpoint
-
ImpactReceive EXIF and internal identifiers of others' images
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires an authenticated WordPress account with the Contributor role or higher on the target site (typically a multi-author / photographer-client site running the Photo Gallery, Sliders, Proofing and Themes plugin at a version between 3.59.5 and 4.5.0). No user interaction and no special configuration are needed beyond having the plugin installed and holding a Contributor+ account. Limiting factors: exploitation is impossible for anonymous/unauthenticated visitors, and the disclosed data is limited to image metadata (EXIF camera make/model and capture timestamp, plus internal checksums and identifiers) - no image files, credentials, or user PII are exposed, capping impact at low confidentiality. |
| Impact | This is a low-severity information-disclosure flaw (CWE-639, insecure direct object reference / broken object-level authorization) whose real-world priority is minor. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N = 2.7) reflects confidentiality-only impact on low-sensitivity data. Note a discrepancy: the vendor scored PR:H, but the description explicitly states exploitation is available to 'the Contributor role and above,' which is a LOW-privilege WordPress role - this argues for PR:L, raising the base score to roughly 4.3, still Medium at most. A publicly available exploit exists (POC=YES via WPScan), which raises exploitability signal, but there is no EPSS score and no CISA KEV listing provided, and no SSVC data. Combined with the trivial nature of the leaked data (image EXIF subset - camera make/model, capture timestamp - plus internal checksums/identifiers), this is a low-real-risk issue despite POC availability: it requires an authenticated account and leaks only non-credential metadata. Not an urgent priority; patch during normal maintenance. |
| Exploit ScenarioDerived | An attacker who has obtained (or been granted) a Contributor-level account on a multi-author WordPress site calls the plugin's image-record read endpoint with the ID of an image belonging to another user's gallery. Because ownership is never checked, the endpoint returns that image's stored EXIF subset and internal checksums/identifiers that the plugin otherwise reserves to administrators. A public exploit for this is available via WPScan. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Missing object-level authorization in the Photo Gallery, Sliders, Proofing and Themes WordPress plugin before 4.5.0 allows authenticated users with the Contributor role or higher to read the stored metadata of any image on the site, including images that belong to other users' galleries; publicly available exploit code exists. Exploitation requires an authenticated Contributor+ account on a site running an affected version (3.59.5 through 4.5.0), needs no user interaction or special configuration, and is impossible for anonymous visitors, which caps the practical impact at low confidentiality loss. The disclosed data is limited to the image's stored EXIF subset (camera make and model, capture timestamp) plus internal checksums and identifiers that the plugin's own capability-gated read path normally reserves for administrators, so no image files, credentials, or user PII are exposed and overall priority is minor.
RemediationAI
Vendor-released patch: 4.5.0 - upgrade the Photo Gallery, Sliders, Proofing and Themes WordPress plugin to 4.5.0 or later, which is the fix version implied by the affected range recorded in ENISA EUVD (3.59.5 < 4.5.0); update through the WordPress plugin dashboard or WP-CLI ('wp plugin update') and confirm the installed version afterwards, then review the WPScan advisory at https://wpscan.com/vulnerability/58759289-adca-47d5-8c15-c073c9f14c31/ for any vendor notes. Where an upgrade cannot be applied immediately, the highest-value compensating control is to audit and reduce privileged accounts: remove or downgrade Contributor-and-above accounts that do not genuinely need them, since exploitation requires an authenticated Contributor+ session and anonymous visitors cannot trigger the flaw - the trade-off is operational disruption for legitimate authors and photographers. Alternatively, temporarily deactivate the plugin if image galleries are not business-critical, accepting the loss of the affected functionality, or place the site behind an access restriction or WAF rule that blocks direct object-reference access to the plugin's image-record read path for low-privileged sessions, recognizing that such rules can be bypassed by parameter variation and may break legitimate gallery metadata loading. As an interim monitoring measure, review logs for Contributor-level accounts requesting image records they do not own, including sequential or non-owned identifiers, to detect attempted exploitation; note that the exposure is confined to image metadata (EXIF make/model and capture timestamp) plus internal checksums and identifiers, so no credential or file-content rotation is required as a result of this issue alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-639 (Authorization Bypass Through User-Controlled Key), commonly described as an insecure direct object reference or broken object-level authorization (BOLA). The WordPress plugin exposes a read path for image records that accepts a caller-supplied image/attachment identifier but fails to verify that the requesting user is entitled to that specific record, a check the plugin's own administrator-only path performs via capability gating. Because the server trusts the object reference rather than the requester's ownership or role, any account at the Contributor level or above can enumerate or supply identifiers and receive the record back, including the image's stored EXIF subset (camera make and model, capture timestamp) and internal checksums and identifiers. The vulnerable component is the WordPress plugin product tracked under CPE cpe:2.3:a:unknown:photo_gallery,_sliders,_proofing_and_themes:*:*:*:*:*:*:*:* (vendor unassigned in the CPE dictionary), reported by WPScan and mirrored under ENISA EUVD-2026-83664, with affected versions listed as 3.59.5 through 4.5.0. The underlying technology is the WordPress permission and capability model: the plugin's REST/AJAX-facing record lookup applies capability checks inconsistently, so an object-level ownership/entitlement check that should accompany the capability gate is absent on the lower-privileged path. The 2.7 score in the advisory (PR:H) reflects a higher-privilege reading of the same flaw, while the independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, reflecting that Contributor-level accounts are sufficient and that the consequence is limited to metadata confidentiality.
Know when Photo Gallery Sliders Proofing And Themes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Network-reachable endpoint, low complexity, requires only a low-privilege Contributor account (PR:L, not vendor's PR:H); leaks low-sensitivity image metadata so C:L, I:N, A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Arbitrary file write - escalating to remote code execution on hosts that execute PHP from upload directories - affects t
Improper authorization in the WordPress plugin Photo Gallery, Sliders, Proofing and Themes before version 4.5.0 lets a u
Authenticated WordPress users who hold only the gallery-management capability of the plugin Photo Gallery, Sliders, Proo
Authenticated users who have been granted the plugin's gallery-management capability can overwrite the stored settings o
Exploit-DB