CVE-2026-81650 Overview
CVE-2026-81650 affects the Photo Gallery, Sliders, Proofing WordPress plugin in versions before 4.5.0. The plugin fails to validate file extensions inside uploaded archives due to a variable reuse bug in the validation loop. A user granted the plugin's gallery-management capability by an administrator can write arbitrary files to a web-accessible directory. On hosts that execute the resulting files, this leads to arbitrary code execution [CWE-434].
Critical Impact
Authenticated users with gallery-management privileges can upload arbitrary files, including PHP scripts, and achieve remote code execution on the underlying web server.
Affected Products
- Photo Gallery, Sliders, Proofing WordPress plugin versions before 4.5.0
- WordPress installations running the vulnerable plugin with gallery-management roles assigned
- Web hosts configured to execute PHP files from plugin upload directories
Discovery Timeline
- 2026-09-20 - CVE-2026-81650 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-81650
Vulnerability Analysis
The plugin accepts archive files uploaded through its gallery-management interface and extracts their contents to a web-accessible directory. Before writing each extracted file, the plugin iterates over entries and checks whether the extension is on an allowlist of image types. The check contains a logic flaw that causes it to always pass, allowing files with arbitrary extensions to be written to disk.
Because the target directory is served by the web server, uploading a PHP file and requesting its URL results in code execution in the WordPress user context. Exploitation requires the gallery-management capability, which is normally granted by an administrator. The vulnerability is classified as Unrestricted Upload of File with Dangerous Type [CWE-434].
Root Cause
The root cause is variable reuse. A single variable serves as both the extension-validation flag and the loop counter that iterates over archive entries. Because the loop overwrites the flag on each iteration, the extension check effectively becomes a no-op, and every file in the archive passes validation regardless of its type.
Attack Vector
An authenticated user with gallery-management privileges crafts an archive containing a PHP file alongside a benign image. The attacker uploads the archive through the plugin's gallery import feature. The plugin extracts the archive to a directory under wp-content/, and the attacker requests the PHP file directly to trigger execution.
See the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-81650
Indicators of Compromise
- New files with executable extensions such as .php, .phtml, or .phar inside plugin upload directories under wp-content/
- Recently extracted archive uploads originating from accounts holding gallery-management capability
- HTTP requests to unfamiliar script files inside gallery or media directories returning 200 status codes
- Web shell strings such as eval(, base64_decode(, or system( appearing in files inside gallery folders
Detection Strategies
- Scan wp-content/uploads/ and plugin-specific gallery directories for files whose extensions do not match the allowlist of image formats
- Correlate archive upload events with subsequent HTTP GET requests to newly created files in the same directory
- Alert on file writes to web-accessible directories performed by the PHP-FPM or Apache worker process outside expected media formats
Monitoring Recommendations
- Log and review all uses of the plugin's gallery import feature, including the uploader identity and file names
- Monitor WordPress user role changes that grant gallery-management capability to non-administrator accounts
- Enable file integrity monitoring on plugin directories and alert on creation of files with script extensions
How to Mitigate CVE-2026-81650
Immediate Actions Required
- Update the Photo Gallery, Sliders, Proofing plugin to version 4.5.0 or later
- Audit WordPress accounts that hold the plugin's gallery-management capability and revoke it from untrusted users
- Inspect gallery upload directories for unauthorized files and remove any script content
Patch Information
The vendor addressed the flaw in version 4.5.0 of the Photo Gallery, Sliders, Proofing plugin. The fix corrects the variable reuse so that the extension allowlist check evaluates each extracted file independently. Refer to the WPScan Vulnerability Report for the vendor's remediation notes.
Workarounds
- Restrict the gallery-management capability to trusted administrators until the plugin is updated
- Configure the web server to deny execution of PHP files inside wp-content/uploads/ and plugin gallery directories
- Deploy a web application firewall rule to block archive uploads containing files with non-image extensions
# Deny PHP execution inside WordPress uploads (Apache .htaccess)
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
Require all denied
</FilesMatch>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
