Authorization Bypass in Image Photo Gallery Plugin by WordPress
CVE-2026-104645
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 8 October 2026
Badges
What is CVE-2026-104645?
The Image Photo Gallery Final Tiles Grid plugin prior to version 3.6.14 is susceptible to an authorization bypass vulnerability. This security flaw arises from improper verification of user permissions in multiple gallery and image management operations. The plugin erroneously checks ownership against a different object, or fails to conduct the check altogether. As a result, any authenticated user with contributor-level access or higher can clone, modify, and reorder galleries and images belonging to other users. Furthermore, they can write metadata from the plugin onto arbitrary posts that they do not own, posing a significant risk to user data integrity and privacy.
Affected Version(s)
Image Photo Gallery Final Tiles Grid 0 < 3.6.14
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.