CVE-2026-81651: Photo Gallery WordPress Plugin Auth Bypass

CVE-2026-81651 Overview

CVE-2026-81651 affects the Photo Gallery, Sliders, Proofing and related WordPress plugin in versions prior to 4.5.0. The plugin fails to verify gallery ownership when a user saves gallery settings. Any user granted the gallery-management capability by an administrator can overwrite the stored settings of any gallery on the site. This includes galleries belonging to other users and the underlying filesystem path configuration. The flaw is classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Low-privileged users with gallery-management rights can tamper with any gallery on the site, altering filesystem paths and content owned by other accounts.

Affected Products

Photo Gallery, Sliders, Proofing and related WordPress plugin versions prior to 4.5.0
WordPress sites that grant the plugin's gallery-management capability to non-administrator roles
Multi-author WordPress deployments relying on per-user gallery isolation

Discovery Timeline

2026-09-20 - CVE-2026-81651 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-81651

Vulnerability Analysis

The vulnerability is a broken access control issue in the gallery-save workflow. The plugin exposes a gallery-management capability that administrators can delegate to lower-privileged roles. When a user submits changes through the gallery save endpoint, the plugin checks that the user holds the capability but does not check that the user owns the specific gallery being modified. The request is processed against whichever gallery identifier the client supplies. This is a classic Insecure Direct Object Reference pattern tracked under [CWE-639].

Root Cause

The root cause is a missing ownership check between the authenticated user and the target gallery record. Authorization logic conflates capability possession with per-object entitlement. Any authenticated user with the delegated capability can pass an arbitrary gallery identifier and have the plugin accept the write.

Attack Vector

Exploitation requires an authenticated account holding the plugin's gallery-management capability. The attacker sends a normal gallery save request but substitutes the target gallery identifier for one they do not own. The plugin overwrites the stored configuration, including the filesystem path used to serve gallery assets. This enables tampering with other users' galleries and redirection of gallery output to attacker-controlled paths within the site.

No verified proof-of-concept code is published. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-81651

Indicators of Compromise

Gallery configuration records modified by a user account that is not the gallery owner
Unexpected changes to gallery filesystem path fields in the plugin's database tables
Audit log entries showing gallery save actions performed by non-administrator accounts against galleries they did not create

Detection Strategies

Compare the author or owner field of each gallery record against the WordPress user ID captured in save-action audit logs
Enable WordPress activity logging on the plugin's admin-post and REST endpoints to record which user modified which gallery identifier
Alert on modifications to gallery filesystem path fields, which should be rare in normal operation

Monitoring Recommendations

Monitor HTTP requests to the plugin's gallery save handler for parameter tampering on the gallery ID field
Review the list of WordPress roles that have been granted the plugin's gallery-management capability and validate the assignments
Track file-system writes under the WordPress uploads directory for paths that do not match established per-user conventions

How to Mitigate CVE-2026-81651

Immediate Actions Required

Upgrade the Photo Gallery, Sliders, Proofing and related WordPress plugin to version 4.5.0 or later
Audit which users hold the plugin's gallery-management capability and revoke it where not required
Review existing galleries for unauthorized changes to owner assignments and filesystem paths

Patch Information

The vendor addressed the issue in version 4.5.0 of the plugin by enforcing ownership checks during the gallery save operation. Site operators should update through the WordPress plugin manager or by installing the fixed release manually. Confirm the installed version reports 4.5.0 or higher after the update.

Workarounds

Restrict the plugin's gallery-management capability to administrators only until the update is applied
Deploy a Web Application Firewall rule that blocks gallery save requests where the submitted gallery ID does not match a gallery owned by the requesting user
Temporarily disable the plugin on sites where multiple non-administrator users share gallery-management privileges

bash

# Update the plugin using WP-CLI
wp plugin update photo-gallery --version=4.5.0
wp plugin list --name=photo-gallery --fields=name,status,version