CVE-2026-81654 in Photo Gallery
Summary
by MITRE • 09/20/2026
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/20/2026
The vulnerability identified in versions of the Photo Gallery, Sliders, Proofing and WordPress plugin prior to version 4.5.0 represents a critical failure in access control logic within the application's administrative interface. This flaw specifically affects how image sizing settings are persisted when modified by users with elevated privileges but restricted capabilities. The core issue lies in the absence of an explicit capability check for the options management permission before processing and saving configuration changes. In WordPress architecture, distinct user roles possess varying levels of authority; while some users may be granted gallery-management rights to organize media content, they are typically not authorized to alter global site configurations that affect performance or display across all galleries.
From a technical perspective, this deficiency constitutes an Authorization Bypass through User-Controlled Key issue, which aligns with CWE-284 in the Common Weakness Enumeration taxonomy. The plugin's backend code fails to verify whether the authenticated user possesses the specific capability required to modify global options before executing the save operation. Consequently, any user assigned a role that includes gallery-management permissions can interact directly with the endpoint responsible for saving image sizing parameters. Because the validation logic is missing or incorrectly implemented at this stage, the application accepts and processes these requests without confirming if the actor has the requisite authority to make such changes.
The operational impact of this vulnerability allows unauthorized users to alter settings that apply globally across the entire WordPress site rather than just their specific galleries. Image sizing parameters often influence how media is rendered on frontend pages, affecting bandwidth usage, load times, and visual consistency. An attacker with gallery-management access could manipulate these settings to degrade performance for all visitors or potentially disrupt the layout of other plugins or themes that rely on standard image dimensions. This lack of isolation between user-specific data and global configuration undermines the principle of least privilege intended by WordPress role definitions.
This type of vulnerability is frequently associated with improper authorization checks in web applications, often categorized under ATT&CK technique T1078, which involves valid accounts being used to maintain persistence or escalate privileges within a system environment. Although this specific instance does not directly lead to remote code execution, it facilitates privilege escalation by allowing lower-privileged users to perform administrative functions. This can serve as an initial foothold for further exploitation if combined with other vulnerabilities that leverage misconfigured global settings.
To mitigate this risk, administrators must immediately upgrade the plugin to version 4.5.0 or later where these access controls have been corrected. Until the update is applied, it is advisable to restrict gallery-management capabilities only to trusted users who also hold higher-level administrative privileges if possible. Additionally, implementing strict input validation and ensuring that all configuration endpoints verify user permissions against a comprehensive list of required capabilities can prevent similar issues in other plugins or custom code. Regular security audits focusing on authorization logic are essential for maintaining the integrity of WordPress environments where multiple user roles interact with shared resources.