Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-20T07:16:49.590Z",
  "pubdate": "2026-09-20T07:16:49.590Z",
  "executiveSummary": "The Photo Gallery, Sliders, Proofing and WordPress plugin before version 4.5.0 contains a critical arbitrary file upload vulnerability. The flaw stems from improper file extension validation during the extraction of uploaded archives.\nThis vulnerability allows an attacker possessing the gallery-management capability to bypass security checks and write arbitrary files to the web-accessible directory. By uploading malicious scripts, such as PHP files, an attacker can achieve remote code execution on the underlying server.\nThe root cause is a variable reuse error in the logic responsible for iterating through and validating file extensions within an archive. Because the validation loop is incorrectly terminated or bypassed, the server fails to verify file types effectively.\nThis is a high-severity vulnerability as it allows for full system compromise if the server environment is configured to execute files from the uploads directory. Successful exploitation requires an authenticated user with gallery-management privileges, which may be granted by an administrator to lower-privileged accounts.\nImmediate remediation is required by updating the plugin to version 4.5.0 or later to ensure proper validation logic is implemented.",
  "technicalDetails": "The vulnerability resides in the archive handling logic of the Photo Gallery, Sliders, Proofing and WordPress plugin, specifically within the module responsible for processing and extracting uploaded archive files. The root cause is a logical defect in the validation loop mechanism.\nDuring the extraction process, the plugin is intended to iterate through the contents of an uploaded archive to verify that each file possesses an approved extension before it is written to the filesystem. However, the implementation reuses a variable that also serves as the loop counter. This reuse results in an incorrect termination condition or a logical bypass of the validation check. Because the loop counter is manipulated or reset improperly during the iteration process, the verification logic essentially skips the extension check for subsequent files or fails to correctly evaluate the current file object, allowing the validation to return a positive result regardless of the file's extension.\nThe attack flow proceeds as follows: First, an attacker must have an account on the WordPress installation with the 'gallery-management' capability. Second, the attacker crafts a malicious archive containing one or more files with executable extensions, such as .php, .phtml, or .php5. Third, the attacker uploads this archive through the plugin's gallery management interface. Upon upload, the vulnerable function triggers the extraction process. Due to the faulty loop implementation, the validation logic fails to identify the malicious file types and permits the server to write these files into a web-accessible directory within the WordPress installation.\nOnce the file is written to the server, the attacker can execute arbitrary code by directly requesting the file via a standard HTTP GET request. The impact is significant: if the web server (e.g., Apache, Nginx) is configured to process PHP files in the target directory, the attacker can execute arbitrary system commands with the privileges of the web server user. This facilitates full site compromise, data exfiltration, or the establishment of a web shell for persistent access. The exposure is limited to authenticated users; however, in environments where administrators delegate gallery management to untrusted or compromised accounts, this vulnerability serves as a direct vector for privilege escalation and remote code execution."
}