Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-20T07:16:49.900Z",
  "pubdate": "2026-09-20T07:16:49.900Z",
  "executiveSummary": "The Photo Gallery, Sliders, Proofing and WordPress plugin, prior to version 4.5.0, contains a critical broken access control vulnerability.\nThe flaw exists due to an improper authorization check when processing image manipulation requests, specifically failing to validate the relationship between the authenticated user and the ownership of the target image or gallery.\nThis vulnerability allows any user granted gallery-management capabilities by an administrator to perform unauthorized actions on images across the entire installation, regardless of gallery ownership.\nImpact includes unauthorized data deletion, arbitrary file manipulation, and metadata modification. By exploiting this flaw, an attacker with low-level administrative privileges can compromise the integrity and availability of media content stored by other users.\nThe vulnerability is restricted to users who have been granted the plugin-specific gallery-management capability, meaning an attacker must possess authenticated access with these designated permissions. No additional remote exploitation requirements beyond this authorization are necessary to trigger the flaw.",
  "technicalDetails": "The root cause of this vulnerability is an Insecure Direct Object Reference (IDOR) pattern stemming from missing server-side authorization checks within the plugin's image handling logic. While the application implements a capability-based access control system (e.g., 'gallery-management'), it fails to perform a secondary ownership verification step once the requested action is initiated.\nWhen a user performs operations such as deleting, copying, or re-tagging an image, the plugin processes the request based on the provided image or gallery identifier. Because the backend code does not validate whether the current user is authorized to manage the specific object being targeted, the system assumes that possessing the global 'gallery-management' capability grants unrestricted access to all image objects within the database.\nThe attack flow proceeds as follows: 1) An authenticated user with 'gallery-management' privileges submits an image manipulation request (e.g., via a POST request to an endpoint responsible for gallery management). 2) The plugin verifies the user's global capability but fails to query the database to verify the ownership of the target resource. 3) The backend proceeds to execute the action—such as an image deletion (unlinking files and removing DB entries) or metadata modification—on the object, even if it belongs to a different gallery or user. 4) The server returns a success response, confirming the unauthorized modification.\nThis flaw effectively bypasses logical multi-tenancy controls within the WordPress environment. An attacker can manipulate any image present on the site's WordPress instance. Post-exploitation impact includes the total destruction of image galleries owned by other users, unauthorized exfiltration of image-related data if tagging is used to organize sensitive content, or the corruption of site media libraries.\nAffected versions are all iterations of the 'Photo Gallery, Sliders, Proofing and WordPress plugin' prior to 4.5.0. The vulnerability is present in the server-side code responsible for handling image resource requests, where the logic fails to enforce boundary constraints on object identifiers. Because the capability is persistent for the user, the window of opportunity for exploitation is continuous until the plugin is updated to include explicit ownership validation."
}