CVE-2026-27424: Final Tiles Grid Auth Bypass Vulnerability

CVE-2026-27424 Overview

CVE-2026-27424 is a Missing Authorization vulnerability [CWE-862] in the WP Chill Image Photo Gallery Final Tiles Grid WordPress plugin. The flaw affects all versions up to and including 3.6.11. Authenticated attackers with low privileges can exploit incorrectly configured access control security levels to perform actions that should be restricted to higher-privileged roles.

The vulnerability is exploitable over the network and requires low privileges with no user interaction. The CVSS impact is limited to confidentiality, with no direct integrity or availability impact.

Critical Impact

Authenticated users with minimal privileges can access plugin functionality that lacks proper authorization checks, potentially exposing gallery configuration or content data within WordPress sites running the affected plugin.

Affected Products

• WP Chill Image Photo Gallery Final Tiles Grid plugin for WordPress
• All versions from n/a through 3.6.11
• WordPress sites with the final-tiles-grid-gallery-lite plugin installed

Discovery Timeline

• 2026-05-20 - CVE-2026-27424 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-27424

Vulnerability Analysis

The vulnerability stems from missing authorization checks within plugin endpoints exposed by the Image Photo Gallery Final Tiles Grid plugin. The plugin fails to validate whether the authenticated user holds the required capability before executing privileged operations.

WordPress plugins typically guard sensitive AJAX or REST endpoints with current_user_can() capability checks combined with nonce verification. When these checks are absent or incorrectly configured, any authenticated user, including subscribers, can invoke functions that should be restricted to administrators or editors.

The issue is classified under CWE-862: Missing Authorization. Refer to the Patchstack Vulnerability Report for additional technical context.

Root Cause

The root cause is incorrectly configured access control security levels in the plugin's request handlers. The plugin registers callbacks that act on user-supplied input without enforcing role or capability requirements appropriate for the action being performed.

Attack Vector

An attacker first obtains a low-privileged authenticated session, such as a subscriber account on a WordPress site that allows open registration. The attacker then issues crafted HTTP requests to the plugin's exposed endpoints. Because the endpoints lack authorization checks, the server executes the privileged action and returns the response to the unauthorized user.

The vulnerability requires no user interaction and can be automated against any WordPress instance running a vulnerable plugin version.

No public proof-of-concept exploit code is available at this time. The vulnerability mechanism is described in prose only.

Detection Methods for CVE-2026-27424

Indicators of Compromise

• Unexpected HTTP POST or GET requests to admin-ajax.php or REST routes referencing the final-tiles-grid-gallery-lite plugin from low-privileged user sessions.
• WordPress audit log entries showing gallery configuration changes initiated by non-administrator accounts.
• New or modified gallery records that do not correspond to legitimate editorial activity.

Detection Strategies

• Inventory WordPress installations to identify sites running final-tiles-grid-gallery-lite version 3.6.11 or earlier.
• Review web server access logs for repeated requests to plugin endpoints originating from subscriber-level accounts.
• Deploy a WordPress security plugin that logs capability check failures and unusual AJAX activity.

Monitoring Recommendations

• Correlate authentication events with subsequent privileged plugin actions to flag mismatches between user role and executed operation.
• Monitor for spikes in account registrations followed by API calls to the affected plugin endpoints.
• Alert on any modification of gallery data outside of expected administrative workflows or maintenance windows.

How to Mitigate CVE-2026-27424

Immediate Actions Required

• Update the Image Photo Gallery Final Tiles Grid plugin to a version later than 3.6.11 once the vendor publishes a fix.
• Audit all existing WordPress user accounts and remove unnecessary subscriber or low-privileged accounts.
• Disable open user registration on WordPress sites that do not require it.

Patch Information

At the time of publication, the advisory lists affected versions from n/a through 3.6.11. Site administrators should consult the Patchstack Vulnerability Report and the official WordPress plugin repository for fixed release information.

Workarounds

• Deactivate the Image Photo Gallery Final Tiles Grid plugin until a patched version is installed.
• Restrict access to the WordPress administrative interface and admin-ajax.php using a web application firewall rule that blocks plugin-specific endpoints for non-administrator roles.
• Apply a virtual patch through a WordPress security plugin that enforces capability checks on the affected routes.

# Configuration example: block plugin AJAX actions for non-admins via WAF rule
# Pseudocode - adapt to your WAF syntax
if request.uri contains "admin-ajax.php" and
   request.body contains "action=final_tiles_" and
   session.role != "administrator":
     deny