Photo Gallery EUVD-2026-83666

Exploitation requires an authenticated WordPress user who has been explicitly granted the plugin's gallery-management capability by an administrator; that user can then save image sizing settings even though they lack the plugin's options capability, and the changes apply site-wide. Limiting factors: attacker must already hold the delegated gallery-management role (PR:L, not a public/unauthenticated attacker), the plugin (Photo Gallery, Sliders, Proofing and Themes) must be installed at a version before 4.5.0, and impact is confined to integrity of image-sizing configuration - no data disclosure or availability loss. This is a trust-boundary erosion between two internal privilege levels rather than remote unauthenticated compromise.

This is a genuinely low-risk authorization flaw, and every signal agrees. The CVSS 3.1 base is 3.1 (vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N): network-reachable but requires an authenticated user (PR:L) who has already been granted the plugin's gallery-management capability by an administrator, and the only impact is integrity (I:L) - changing image sizing settings that apply site-wide, with no confidentiality or availability effect. A public POC exists (WPScan) and a vendor patch is available (4.5.0), but there is no EPSS score and no CISA KEV listing in the provided data, so there is no evidence of active or automated exploitation - POC availability and active exploitation are distinct, and only the former is present here. I dispute the vendor's AC:H: a missing capability check is a straightforward, deterministic condition with no special complexity, which would raise the base to ~4.3 (AC:L) - still low. The practical ceiling on risk is that the attacker must already be a trusted delegated user (someone the admin deliberately gave gallery-management rights to), so this is a privilege-boundary erosion rather than an externally exploitable takeover. Net: correctly a low-priority issue despite a public POC.

An administrator delegates gallery-management to a staff/photographer account that should NOT control global plugin options. That user submits the image-sizing settings save request; because the plugin fails to verify the higher options capability, their change is accepted and applied across the entire site's galleries. A public POC from WPScan demonstrates the request, but exploitation requires the attacker to already hold the delegated gallery-management capability (PR:L).