Unauthorized Image Management in Photo Gallery Plugin by WordPress
CVE-2026-81653

Currently unrated

Key Information:

Vendor

WordPress
Status
Photo Gallery, Sliders, Proofing And Themes
Vendor
CVE Published:
20 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-81653?

The Photo Gallery, Sliders, Proofing plugin for WordPress prior to version 4.5.0 fails to properly validate user permissions when managing images within galleries. This vulnerability allows users who are granted gallery-management capabilities by an administrator to manipulate images across galleries, including deleting, copying, and re-tagging images that belong to other users. Such weaknesses can lead to unauthorized access and control over potentially sensitive content, emphasizing the need for timely updates and robust permission settings.

Affected Version(s)

Photo Gallery, Sliders, Proofing and Themes 0 < 4.5.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-81653 - Proof of Concept

References

https://wpscan.com/vulnerability/0bceb61b-6986-4669-896c-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erwan LR (WPScan)
WPScan
.