Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-20T07:16:49.700Z",
  "pubdate": "2026-09-20T07:16:49.700Z",
  "executiveSummary": "This vulnerability is classified as an Improper Authorization (Broken Access Control) flaw affecting the Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0.\nThe security flaw stems from a failure to perform adequate ownership verification during the gallery configuration saving process.\nThe vulnerability allows an authenticated user, who has been assigned gallery-management capabilities by an administrator, to perform unauthorized modifications to galleries they do not own.\nAn attacker can exploit this to overwrite critical gallery settings, including the configured filesystem path, effectively allowing for unauthorized administrative manipulation of arbitrary galleries across the WordPress installation.\nThe impact is significant, as it permits lateral movement within the application's gallery management system, potentially leading to unauthorized data exposure, corruption, or redirection of file assets.\nExploitation requires the attacker to possess at least the base gallery-management capability, meaning the vulnerability is limited to authenticated users with specific, albeit low-level, administrative privileges within the plugin context.",
  "technicalDetails": "The vulnerability is a manifestation of Insecure Direct Object Reference (IDOR) occurring due to insufficient server-side authorization checks within the gallery management modules of the Photo Gallery, Sliders, Proofing and WordPress plugin.\nThe root cause is the absence of an ownership validation mechanism within the logic responsible for processing save requests for gallery configurations. While the plugin verifies that a user possesses the general 'gallery-management' capability, it fails to perform an authorization check to verify if the specific Gallery ID (GID) being modified is owned by or assigned to the requesting user.\nThe attack flow proceeds as follows: An authenticated user with gallery-management privileges identifies a target gallery belonging to another user. The attacker captures or crafts a request to the plugin's gallery-saving endpoint, supplying the GID of the target gallery along with modified configuration parameters. Because the server-side code performs no verification of ownership, it processes the request and updates the database records associated with the target gallery.\nA primary security concern is the ability of the attacker to modify the 'filesystem path' setting for a gallery. By altering this path, an attacker could potentially redirect the plugin to serve files from unauthorized directories or point to a malicious file structure, facilitating further manipulation of the WordPress filesystem or potentially staging for other injection-based attacks.\nThe scope of affected versions includes all releases of the Photo Gallery, Sliders, Proofing and WordPress plugin prior to 4.5.0. The vulnerability is restricted to environments where the administrator has granted users the gallery-management capability, as an attacker must be authenticated and authorized to interact with the plugin's management interface.\nPost-exploitation impact includes the loss of integrity for gallery settings, unauthorized exposure of private gallery content, and the potential for an attacker to reconfigure site assets in a way that disrupts service or facilitates secondary malicious activity. Since the application fails to validate the scope of the user's permission against the specific object requested, the security boundary between users is effectively non-existent."
}