CVE-2026-102399 in Photo Gallery Plugin
Summary
by MITRE • 09/30/2026
Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as an unauthenticated Cross-Site Request Forgery within the Photo Gallery plugin for WordPress, specifically affecting versions up to and including 1.21.0, represents a significant security flaw that undermines the integrity of administrative actions through maliciously crafted requests. This type of attack exploits the trust that a web application has in a user's browser by tricking an authenticated administrator into performing unintended actions without their knowledge or consent. In this specific context, the lack of proper anti-CSRF token validation allows external sites to submit forms or trigger API endpoints on behalf of logged-in administrators, effectively bypassing standard authentication checks because the session cookies are automatically included in requests initiated from third-party domains.
From a technical perspective, the core issue lies in the absence of synchronization tokens that verify the origin and intent of state-changing HTTP requests. When an administrator visits a maliciously constructed webpage hosted by an attacker, JavaScript embedded on that page can programmatically send POST or GET requests to the vulnerable endpoints within the Photo Gallery plugin. Since WordPress sessions are typically maintained via cookies which browsers attach automatically to all requests for that domain, the server processes these forged requests as if they originated from legitimate administrative interactions. This flaw is particularly dangerous because it does not require any prior authentication step by the attacker; instead, it relies entirely on the victim being logged into their WordPress dashboard at the time of exploitation.
The operational impact of this vulnerability can be severe depending on the capabilities exposed through the affected plugin endpoints. Attackers with CSRF privileges often gain the ability to modify site configurations, upload malicious media files that may contain web shells or other malware, delete critical gallery data causing loss of business continuity, or even escalate privileges if specific administrative functions are accessible via these unprotected routes. For instance, an attacker could potentially alter settings related to image optimization, public sharing permissions, or database connections, thereby compromising the confidentiality and integrity of the entire WordPress installation. The risk is amplified in environments where multiple users have administrator access, as any one of them falling victim to such a phishing-style attack can lead to full site compromise.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery attacks involving insufficient verification of request intent. Furthermore, it maps directly to the MITRE ATT&CK framework under technique T1089, specifically within the Disabling Security Tools or modifying system configurations sub-tactics if the CSRF actions allow for such changes. The exploitation vector falls under Initial Access via Spearphishing Link (T1566.002) where the attacker lures a privileged user to a malicious site that triggers the forgery in the background without any visual indication of activity, making detection difficult through standard logging unless specific anomaly detection is implemented at the application or network level.
Mitigation strategies must focus on implementing robust anti-CSRF mechanisms immediately upon upgrading past version 1.21.0. The primary defense involves integrating non-predictable synchronization tokens into all state-changing forms and AJAX requests, ensuring that each request includes a unique value tied to the user's session which is validated server-side before processing. Additionally, developers should implement SameSite cookie attributes set to Strict or Lax to prevent browsers from sending cookies in cross-site contexts by default. For site administrators unable to upgrade immediately due to compatibility concerns, temporary mitigations include restricting access to WordPress admin pages via IP whitelisting and monitoring for unusual POST request patterns originating from external domains using Web Application Firewalls configured with specific rulesets against CSRF attacks. Regular security audits and penetration testing should also be conducted to identify similar gaps in other plugins or custom code that may share this architectural weakness.