Missing Authorization in HM Books Gallery Plugin for WordPress
CVE-2026-5347

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
WP Books Gallery – Build Stunning Book Showcases & Libraries In Minutes
Vendor
CVE Published:
24 April 2026

What is CVE-2026-5347?

The HM Books Gallery plugin for WordPress is susceptible to a Missing Authorization vulnerability due to inadequate capability checks in the admin_init hook. Specifically, the code responsible for updating permalink settings lacks nonce verification and only checks for the 'permalink_structure' POST parameter. This oversight enables unauthenticated attackers to alter the custom post type slug associated with the books gallery, potentially disrupting the URL structure of all book entries and negatively impacting existing links and SEO rankings. It is imperative for users to review and update their plugin to mitigate this risk.

Affected Version(s)

WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes 0 <= 4.8.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-books-galle...
https://plugins.trac.wordpress.org/browser/wp-books-galle...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhirup Konwar
.