EUVD-2026-83665
GHSA-vpjm-x6rh-jvwr
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Authenticated capability-holder (PR:L) over network; image IDs are enumerable so AC:L; copy exposes others' images (C:L), re-tag modifies (I:L), delete removes them (A:L).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.
AnalysisAI
Improper authorization in the WordPress plugin Photo Gallery, Sliders, Proofing and Themes before version 4.5.0 lets a user who has been granted the plugin's gallery-management capability delete, copy, and re-tag images that belong to other users' galleries. The flaw is an IDOR-class (CWE-639) authorization bypass that requires an authenticated WordPress account already holding that capability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L per our independent assessment; the published score is 4.2 with a more conservative AC:H vector), so anonymous visitors cannot reach it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account that an administrator has explicitly granted the plugin's gallery-management capability (PR:L insider) - anonymous visitors cannot exploit it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-severity authorization flaw, not a high-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the Photo Gallery, Sliders, Proofing and Themes plugin to 4.5.0 or later - this is the fixed version published by the vendor and reflected in the EUVD '0 <4.5.0' affected range; confirm the update through the WPScan entry at https://wpscan.com/vulnerability/0bceb61b-6986-4669-896c-4279ecef0603/ and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-81653. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file write - escalating to remote code execution on hosts that execute PHP from upload directories - affects t
Authenticated WordPress users who hold only the gallery-management capability of the plugin Photo Gallery, Sliders, Proo
Authenticated users who have been granted the plugin's gallery-management capability can overwrite the stored settings o
Missing object-level authorization in the Photo Gallery, Sliders, Proofing and Themes WordPress plugin before 4.5.0 allo
Share
External POC / Exploit Code
Leaving vuln.today