Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-20T07:16:49.997Z",
  "pubdate": "2026-09-20T07:16:49.997Z",
  "executiveSummary": "This vulnerability is an Improper Authorization flaw identified in the Photo Gallery, Sliders, Proofing and WordPress plugin. The vulnerability allows authenticated users with lower-level privileges to bypass intended access controls.\nSpecifically, the plugin fails to perform an adequate capability check before executing administrative functions related to image sizing settings.\nBy manipulating requests, an attacker assigned the 'gallery-management' capability can modify global plugin configurations that are intended to be restricted to users holding the 'options' capability.\nThe primary impact is unauthorized configuration modification, which affects the entire site instance where the plugin is active. While this does not provide remote code execution, it grants an unauthorized user the ability to alter site-wide aesthetic and functional parameters, potentially leading to visual site disruption or defacement.\nSuccessful exploitation requires the attacker to possess at least the 'gallery-management' capability, meaning the attacker must be a registered user within the WordPress environment. No specialized external network access is required, as the attack is performed through the plugin's legitimate administrative interface by invoking functions that lack proper server-side authorization checks.\nThis represents a significant failure in the principle of least privilege, as low-privileged gallery managers are effectively granted administrative-level control over plugin-wide settings.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient access control check within the plugin's backend request handling logic. In WordPress development, sensitive administrative settings should be protected by validating the user's capabilities—typically using the current_user_can() function against a high-level privilege like 'manage_options'.\nIn the affected versions (prior to 4.5.0), the code responsible for processing image sizing settings fails to verify if the requesting user holds the required authorization to modify site-wide configuration. Instead, the plugin relies on an inadequate check, likely only validating that the user has a lesser capability, such as 'gallery-management'.\nThe attack flow proceeds as follows: First, an attacker logs into the WordPress administrative panel with credentials authorized for gallery management. Second, the attacker navigates to the plugin's settings interface. Third, the attacker captures the HTTP POST request sent when image sizing parameters are saved. Fourth, the attacker modifies the request payload to include unauthorized configuration values or simply triggers the save action.\nBecause the server-side code performs an insufficient authorization check, the plugin logic accepts the input and updates the global options table in the WordPress database. The vulnerability exists within the component responsible for handling administrative settings updates. Since this component performs the database write operation without verifying the 'options' capability, the authorization bypass is complete.\nThe impact of this exploit is that unauthorized users can change image rendering behavior across the entire WordPress installation. This can lead to significant changes in site layout, the breaking of image displays, or the forcing of suboptimal settings that impact the user experience. Because the setting is stored globally, the changes persist across the site regardless of who visits the pages, unless or until a higher-privileged administrator reverts the settings.\nThis vulnerability is classified as an authorization bypass. It does not exploit a memory corruption or injection vector; rather, it exploits logic within the application's privilege enforcement mechanism. The lack of granular capability validation allows for the elevation of functionality, where a user authorized to perform gallery management operations can inadvertently or maliciously exercise control over plugin-wide administrative properties that should be strictly gated."
}