CVE-2026-104645 in Image Photo Gallery Final Tiles Grid Plugin
Summary
by MITRE • 10/08/2026
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in the Image Photo Gallery Final Tiles Grid WordPress plugin prior to version 3.6.14 represents a critical failure in access control mechanisms, specifically manifesting as an Insecure Direct Object Reference (IDOR) combined with Broken Access Control issues. This flaw allows authenticated users who possess contributor-level privileges or higher to bypass intended security restrictions and perform administrative actions on resources they do not own. The core technical deficiency lies in the plugin's handling of authorization checks during gallery and image management operations. Instead of validating that the requesting user is the legitimate owner of the specific resource being modified, the system either performs ownership verification against an incorrect object identifier or omits the check entirely for certain endpoints. This logical error creates a significant security gap where the application trusts client-supplied identifiers without cross-referencing them against the authenticated user's actual permissions and asset ownership records.
From a technical perspective, this vulnerability enables several malicious actions that compromise data integrity and confidentiality within the WordPress environment. An attacker can clone galleries belonging to other users, effectively stealing content and potentially using it for phishing or impersonation attacks. Furthermore, the ability to modify and reorder images in galleries owned by others allows an adversary to alter visual presentations on a website, which could be used to deface pages or insert misleading information. More critically, the vulnerability permits writing plugin metadata onto arbitrary posts that are not owned by the attacker. This capability extends beyond simple content manipulation; it can lead to persistent state changes and potentially facilitate further exploitation vectors if those post IDs are linked to other sensitive functionalities within the WordPress ecosystem. The lack of proper object-level authorization means that any authenticated user, regardless of their role relative to the target resource, can execute these actions with impunity.
The operational impact of this vulnerability is substantial for organizations relying on multi-author WordPress sites where contributors have varying levels of access. It undermines the principle of least privilege by allowing lower-privileged users to interfere with higher-privilege content or administrative structures. For site administrators, this results in potential data loss, unauthorized modification of public-facing media assets, and a compromised trust model for user-generated content. The ability to write metadata on arbitrary posts is particularly concerning as it may allow an attacker to inject malicious attributes into pages they do not control, potentially affecting search engine optimization metrics or triggering unintended behavior in themes that rely on specific meta fields. This level of access escalation can serve as a stepping stone for more severe attacks, such as cross-site scripting if the metadata is rendered unsafely later, or privilege escalation if combined with other vulnerabilities in the theme or core WordPress installation.
To mitigate this vulnerability, immediate action must be taken to update the Image Photo Gallery Final Tiles Grid plugin to version 3.6.14 or later, where these authorization checks have been corrected. Site administrators should verify that all instances of the plugin are updated across their network if running a multisite environment. In addition to patching, it is advisable to review user roles and ensure that contributor-level accounts are only granted necessary permissions for content creation rather than management functions unless absolutely required. Implementing strict input validation on server-side requests and ensuring that every action handler explicitly verifies the ownership of the target object against the session's authenticated user ID will prevent similar issues in future developments. Regular security audits focusing on access control logic, particularly around resource manipulation endpoints, are essential to maintain a robust defense posture against broken access control attacks as defined by industry standards such as CWE-284 and MITRE ATT&CK technique T1078.