CVE-2026-22345: WP Image Gallery Object Injection Flaw

CVE-2026-22345 Overview

CVE-2026-22345 is a deserialization of untrusted data vulnerability affecting the A WP Life Image Gallery plugin for WordPress. This plugin, also known as "Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery" (new-image-gallery), is susceptible to PHP Object Injection attacks through improper handling of serialized data. An authenticated attacker with low privileges can exploit this vulnerability to inject malicious PHP objects, potentially leading to arbitrary code execution, data manipulation, or complete site compromise.

Critical Impact

Authenticated attackers can exploit this PHP Object Injection vulnerability to execute arbitrary code, access sensitive data, or fully compromise WordPress installations running affected versions of the Image Gallery plugin.

Affected Products

• A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery (new-image-gallery) versions through 1.6.0
• WordPress sites using the affected plugin versions

Discovery Timeline

• 2026-02-20 - CVE-2026-22345 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-22345

Vulnerability Analysis

This vulnerability stems from the unsafe deserialization of user-controlled data within the Image Gallery plugin. PHP Object Injection (CWE-502) occurs when an application deserializes untrusted input using functions like unserialize() without proper validation. When combined with exploitable "magic methods" such as __wakeup(), __destruct(), or __toString() in the application or its dependencies, attackers can manipulate object properties to trigger dangerous code execution paths.

The vulnerability requires low-privilege authentication (such as a subscriber account), meaning attackers need valid WordPress credentials to exploit this flaw. However, once authenticated, no user interaction is required to trigger the vulnerability. The potential impact includes complete compromise of confidentiality, integrity, and availability of the affected WordPress installation.

Root Cause

The root cause of CVE-2026-22345 is the improper handling of serialized PHP data within the Image Gallery plugin. The plugin accepts serialized data from user input without adequate validation or sanitization before passing it to PHP's unserialize() function. This allows attackers to craft malicious serialized payloads containing arbitrary PHP objects that, when deserialized, can exploit existing class methods (gadget chains) present in WordPress core, the plugin itself, or other installed plugins and themes.

Attack Vector

The attack is network-based and can be executed remotely by any authenticated user with low-level privileges on the WordPress installation. The attacker crafts a malicious serialized PHP object payload targeting known gadget chains within the WordPress ecosystem. When the plugin deserializes this payload, the injected objects are instantiated with attacker-controlled properties.

Depending on available gadget chains in the environment, successful exploitation can lead to:

• Remote Code Execution through file write operations or command execution
• Database manipulation and data exfiltration
• Privilege escalation to administrator level
• Installation of backdoors or web shells
• Complete WordPress site takeover

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-22345

Indicators of Compromise

• Suspicious serialized data patterns in WordPress database options or post meta fields associated with the Image Gallery plugin
• Unexpected PHP object instantiation errors in server logs
• New or modified files in the WordPress installation directory, particularly in wp-content/uploads/ or plugin directories
• Unauthorized administrator accounts or modified user privileges

Detection Strategies

• Monitor web application logs for POST requests containing serialized PHP data patterns (e.g., O: prefix followed by object definitions) targeting plugin endpoints
• Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object injection attempts
• Perform regular file integrity monitoring to detect unauthorized modifications to WordPress core, plugin, or theme files
• Use WordPress security plugins that can detect object injection attempts in real-time

Monitoring Recommendations

• Enable detailed logging for the Image Gallery plugin and monitor for unusual activity patterns
• Review authentication logs for low-privilege accounts making unusual administrative-type requests
• Set up alerts for database modifications to plugin-related tables and WordPress options
• Implement SentinelOne's Singularity platform for endpoint detection and response to identify post-exploitation activity

How to Mitigate CVE-2026-22345

Immediate Actions Required

• Update the Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin to a patched version (above 1.6.0) immediately
• If an update is not available, consider temporarily deactivating and removing the plugin until a patch is released
• Review WordPress user accounts and remove any unnecessary accounts with contributor-level access or higher
• Audit the WordPress installation for signs of compromise, including unauthorized files or database modifications
• Reset credentials for all administrative and editor accounts as a precautionary measure

Patch Information

Affected installations should update the new-image-gallery plugin to a version newer than 1.6.0 once a patched release becomes available. Monitor the official WordPress plugin repository and the Patchstack Vulnerability Report for patch availability announcements.

Workarounds

• Deactivate and delete the Image Gallery plugin if it is not essential to site functionality until a patch is available
• Implement strict user registration controls and limit the number of authenticated users on the WordPress site
• Deploy a Web Application Firewall (WAF) with rules to block serialized PHP object patterns in HTTP requests
• Consider using PHP configuration options like disable_functions to restrict dangerous functions that object injection attacks commonly target

# WordPress security hardening configuration
# Add to wp-config.php to help limit attack surface

# Disable file editing from WordPress admin
define('DISALLOW_FILE_EDIT', true);

# Force SSL for admin and logins
define('FORCE_SSL_ADMIN', true);

# Limit login attempts (requires plugin or custom implementation)
# Consider implementing fail2ban or similar at server level