Unauthorized Gallery Management in Photo Gallery and Slider Plugin by WordPress
CVE-2026-81651

Currently unrated

Key Information:

Vendor

WordPress
Status
Photo Gallery, Sliders, Proofing And Themes
Vendor
CVE Published:
20 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-81651?

The Photo Gallery, Sliders, and Proofing plugin for WordPress, prior to version 4.5.0, contains a flaw that allows any user with gallery-management capabilities, granted by an administrator, to overwrite the settings of any gallery on the site. This includes the ability to modify critical settings such as the filesystem path of galleries owned by other users, resulting in unauthorized access and potential data manipulation.

Affected Version(s)

Photo Gallery, Sliders, Proofing and Themes 0 < 4.5.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-81651 - Proof of Concept

References

https://wpscan.com/vulnerability/69ccebff-414d-49bb-b914-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Murad Akhmedov
WPScan
.