CVE-2026-81650 in Photo Gallery
Summary
by MITRE • 09/20/2026
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/20/2026
The vulnerability identified in versions of the Photo Gallery, Sliders, Proofing plugin prior to version 4.5.0 represents a critical security flaw rooted in improper input validation during file upload operations. This issue specifically affects the mechanism used for extracting files from uploaded archives within the WordPress environment. The core technical defect lies in how the application handles loop counters when processing multiple entries within an archive. A variable intended to track iteration is incorrectly reused as a loop counter, which fundamentally breaks the logic required to validate each individual file's extension against a whitelist of allowed types. Because this validation check relies on a state that is corrupted by the reuse of the variable, the security control effectively becomes bypassed for all but potentially the first or last item depending on implementation specifics, resulting in the condition where the extension check always passes regardless of the actual file type being processed.
This failure to enforce strict extension validation allows authenticated users who have been granted gallery-management capabilities by an administrator to upload malicious payloads disguised as legitimate media files. By exploiting this flaw, attackers can write arbitrary files into a web-accessible directory on the server hosting the WordPress installation. The severity of this vulnerability is significantly amplified because it grants the ability to execute code if the host environment supports execution for the uploaded file type. For instance, uploading a PHP script with an allowed extension or manipulating extensions to bypass filters can lead directly to remote code execution. This transforms what might seem like a simple upload issue into a full system compromise scenario where the attacker gains control over the server's runtime environment.
From a classification perspective, this vulnerability aligns closely with CWE-434, which describes the unrestricted uploading of files that are capable of being executed by the web server. It also relates to CWE-20, improper input validation, as the system fails to correctly sanitize and verify the integrity of user-supplied data before processing it. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates techniques associated with Initial Access via Web Applications and specifically aligns with Tactic TA0003 Persistence or TA0002 Execution through uploaded web shells. The exploitation path typically involves the attacker uploading a malicious archive containing executable scripts, leveraging the flawed extraction logic to place these files in public-facing directories where they can be invoked directly via HTTP requests.
The operational impact of this vulnerability is severe for any organization relying on WordPress plugins for media management and presentation. Successful exploitation allows an adversary to establish persistent access, exfiltrate sensitive data stored within the web root or associated databases, and potentially pivot further into internal networks if the server has broader connectivity. The presence of such a backdoor undermines the integrity of the entire application stack, as it bypasses standard authentication boundaries by relying on legitimate administrative privileges that were granted to lower-privileged users for gallery management purposes. This highlights the risk inherent in granting broad file manipulation permissions without rigorous technical controls at every step of the data processing pipeline.
Mitigation strategies must prioritize immediate remediation through software updates and strict configuration hardening. The primary defense is to upgrade the Photo Gallery, Sliders, Proofing plugin to version 4.5.0 or later, where the variable reuse bug has been corrected and proper extension validation logic is enforced for each file in an archive. In environments where upgrading is not immediately feasible, administrators should restrict gallery-management capabilities only to trusted users with high-level security awareness. Additionally, implementing server-side controls such as disabling script execution in upload directories via web server configuration (e.g., using .htaccess rules or Nginx deny directives) can provide a critical layer of defense-in-depth. This ensures that even if an attacker successfully uploads a malicious file due to the plugin flaw, the operating system and web server will prevent its execution, thereby neutralizing the remote code execution vector entirely.