CVE-2026-105977: Portfolio Filter Gallery Privilege Escalation

CVE-2026-105977 Overview

CVE-2026-105977 is a broken access control vulnerability [CWE-639] in the Portfolio Filter Gallery WordPress plugin versions before 2.2.1. The plugin fails to perform a per-object authorization check before deleting an attachment. As a result, authenticated users with the Contributor role or higher can permanently delete media attachments owned by other users, including administrators. The flaw is an Insecure Direct Object Reference (IDOR) against the WordPress media library exposed through the plugin's deletion handler.

Critical Impact
Authenticated low-privilege users can destroy media attachments belonging to administrators and other authors, resulting in content loss and integrity impact on affected WordPress sites.

Affected Products

Portfolio Filter Gallery WordPress plugin versions prior to 2.2.1
WordPress sites that allow Contributor-level or higher account registration
Multi-author WordPress installations using the plugin for media galleries

Discovery Timeline

2026-10-10 - CVE-2026-105977 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-105977

Vulnerability Analysis

The vulnerability resides in the Portfolio Filter Gallery plugin's attachment deletion workflow. The plugin exposes an endpoint that accepts an attachment identifier and removes the referenced media object from the WordPress uploads library. The handler verifies that the requester holds a role capable of editing posts but omits a per-object ownership check. An attacker with Contributor permissions can therefore submit an attachment ID belonging to another user and trigger a permanent deletion.

This bypasses the trust boundary WordPress enforces between content authored by different users. Deleted attachments cannot be recovered through the standard WordPress trash mechanism because wp_delete_attachment removes files from disk and the associated database rows.

Root Cause

The root cause is a missing authorization check tied to the target object. The plugin relies on role-based capability checks (such as edit_posts) without calling current_user_can('delete_post', $attachment_id) or verifying that the attachment's post_author matches the current user. This pattern maps to [CWE-639] Authorization Bypass Through User-Controlled Key.

Attack Vector

Exploitation requires an authenticated session at Contributor level or higher and network access to the WordPress site. The attacker enumerates attachment IDs, which are predictable sequential integers exposed through the WordPress REST API and public media URLs. The attacker then issues a crafted request to the plugin's deletion endpoint with a target attachment ID. The server deletes the attachment without validating ownership. Refer to the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-105977

Indicators of Compromise

Unexpected wp_delete_attachment calls originating from Contributor accounts in PHP or application logs
Missing media files referenced by posts authored by administrators or editors
Sudden drops in attachment counts in the WordPress media library without corresponding admin activity
POST requests from Contributor sessions to Portfolio Filter Gallery plugin endpoints targeting attachment IDs not owned by the requester

Detection Strategies

Audit WordPress activity logs for attachment deletion events where the acting user is not the attachment author
Correlate HTTP access logs with the plugin's AJAX or REST route to flag requests referencing attachment IDs across user boundaries
Deploy a web application firewall rule to log and alert on deletion requests to the plugin endpoint from non-administrator sessions

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/uploads directory to capture unauthorized deletions
Forward WordPress audit logs and web server access logs to a centralized SIEM for cross-user correlation
Track the Contributor and Author account population and review their request patterns against the plugin

How to Mitigate CVE-2026-105977

Immediate Actions Required

Upgrade the Portfolio Filter Gallery plugin to version 2.2.1 or later on all affected WordPress sites
Review Contributor and Author accounts, disable unused accounts, and reset credentials for shared or dormant users
Back up the wp-content/uploads directory and the WordPress database before applying changes

Patch Information

The vendor addressed the vulnerability in Portfolio Filter Gallery version 2.2.1 by introducing a per-object authorization check prior to attachment deletion. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI. Verify the installed version after update in the plugins dashboard.

Workarounds

Deactivate the Portfolio Filter Gallery plugin until the patch is applied if an immediate upgrade is not possible
Restrict Contributor and Author registration on untrusted sites and require administrator approval for new accounts
Deploy a web application firewall rule that blocks the plugin's deletion endpoint for sessions not holding the manage_options capability

bash

# Update Portfolio Filter Gallery via WP-CLI
wp plugin update portfolio-filter-gallery --version=2.2.1

# Verify the installed version
wp plugin get portfolio-filter-gallery --field=version

# If immediate patching is not possible, deactivate the plugin
wp plugin deactivate portfolio-filter-gallery