Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-20T07:16:49.803Z",
  "pubdate": "2026-09-20T07:16:49.803Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in the Photo Gallery, Sliders, Proofing and WordPress plugin in all versions prior to 4.5.0. This flaw allows authenticated users with the Contributor role or higher to bypass intended access controls and access sensitive image metadata across the entire WordPress site. The vulnerability stems from a failure in the plugin's backend to verify whether the requesting user possesses the necessary permissions or ownership rights to view a specific image record before returning it.\nBy exploiting this vulnerability, a low-privileged user can retrieve restricted EXIF data, internal checksums, and system-level identifiers belonging to any image in any gallery, including those owned by other users or restricted to administrators. This unauthorized data exposure undermines the security and privacy boundaries of multi-user WordPress installations, allowing unauthorized internal mapping and potential preparation for further targeted attacks. To mitigate this risk, administrators must immediately update the affected plugin to version 4.5.0 or later.",
  "technicalDetails": "The root cause of this vulnerability lies within the image record retrieval mechanism of the Photo Gallery, Sliders, Proofing and WordPress plugin prior to version 4.5.0. When a user requests details of a specific image, the plugin fails to execute capability or ownership verification checks on the incoming request session. Consequently, the application does not validate whether the requesting user owns the target gallery, possesses administrative capabilities, or is otherwise entitled to access the specified image record.\nNormally, the plugin implements a capability-gated read path that restricts administrative metadata, such as internal system identifiers and database checksums, strictly to users with administrator privileges. However, because the primary data-retrieval endpoint does not enforce authorization checks, any authenticated user with a minimum privilege level of the 'Contributor' role can directly query and obtain these restricted records, effectively rendering the capability-gated security controls useless.\nAn attack flow executing this exploit typically proceeds as follows:\n1. The attacker authenticates to the target WordPress site using a low-privilege account, such as one with the 'Contributor' role.\n2. The attacker targets the vulnerable endpoint used by the Photo Gallery, Sliders, Proofing and plugin to fetch image details, submitting a request containing the identifier of an image record belonging to a different user or restricted gallery.\n3. The plugin receives the request and queries the database for the corresponding image record without verifying if the active Contributor session has the authority to access it.\n4. The backend retrieves the record and returns the full metadata payload to the attacker's session.\nThe resulting data disclosure exposes an EXIF metadata subset, which includes camera make and model details alongside the exact capture timestamp. Furthermore, the payload leaks internal checksums and database identifiers. Because these identifiers are typically shielded behind the plugin's capability-gated path, exposing them provides attackers with precise internal structure information, facilitating potential secondary attacks or database enumeration."
}