CVE-2026-81652: WordPress Photo Gallery Information Disclosure

CVE-2026-81652 Overview

CVE-2026-81652 is an Insecure Direct Object Reference [CWE-639] vulnerability in the Photo Gallery, Sliders, Proofing WordPress plugin before version 4.5.0. The plugin fails to verify that a requesting user is entitled to a given image record before returning it. Authenticated users with the Contributor role or higher can read stored image metadata belonging to other users, including galleries they do not own. Disclosed data includes EXIF fields such as camera make, model, and capture timestamp, along with internal checksums and identifiers that the plugin's own capability-gated read path restricts to administrators.

Critical Impact
Contributor-level accounts can enumerate and read image metadata across every gallery on the site, bypassing the plugin's administrator-only read path.

Affected Products

Photo Gallery, Sliders, Proofing WordPress plugin versions prior to 4.5.0
WordPress installations where the plugin is active with Contributor or higher accounts provisioned
Multi-author WordPress sites relying on the plugin for gallery isolation

Discovery Timeline

2026-09-20 - CVE-2026-81652 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-81652

Vulnerability Analysis

The flaw is a classic authorization check gap in a REST or AJAX read path exposed by the plugin. The endpoint accepts an image identifier and returns the corresponding record without validating ownership or the caller's capability. A user authenticated as a Contributor supplies an arbitrary image ID and receives metadata for any image stored by the plugin.

Returned fields include a subset of EXIF data such as camera make, model, and capture timestamps, plus internal checksums and identifiers. The plugin's capability-gated read path is designed to reserve these fields to administrators, so the endpoint bypasses the intended trust boundary. Exploitation requires authentication but no user interaction, and the impact is limited to confidentiality of image metadata.

Root Cause

The root cause is a missing authorization check on an image lookup handler. The code path evaluates the request as authenticated and proceeds directly to a record fetch keyed by a client-supplied identifier. It does not confirm that the caller owns the image, that the caller has the administrator capability required by the parallel read path, or that the requested record belongs to a gallery the caller can view.

Attack Vector

An attacker with a valid Contributor account authenticates to WordPress and issues requests to the vulnerable endpoint while iterating over image identifiers. The server returns metadata records for each valid ID, including EXIF fields and internal identifiers that should be restricted. The attacker can enumerate the full image inventory and harvest metadata across all authors and galleries.

For technical detail, see the WPScan Vulnerability Report. No public proof-of-concept exploit is currently listed.

Detection Methods for CVE-2026-81652

Indicators of Compromise

Sequential or high-volume requests to the plugin's image metadata endpoint from a single authenticated Contributor session
Successful HTTP 200 responses returning EXIF fields to non-administrator users
Access patterns where image IDs requested by a user do not correspond to galleries or posts they authored

Detection Strategies

Review web server and WordPress access logs for repeated requests to the plugin's image read endpoints containing incrementing id parameters
Correlate authenticated session role with the ownership of image records returned in responses
Alert on Contributor-role sessions that retrieve metadata across a broad range of image identifiers within a short window

Monitoring Recommendations

Enable verbose logging on WordPress REST and admin-ajax endpoints exposed by the plugin
Track per-user request rates against gallery endpoints and flag deviations from baseline author behavior
Ingest WordPress and web server logs into a centralized analytics platform for cross-session correlation

How to Mitigate CVE-2026-81652

Immediate Actions Required

Upgrade the Photo Gallery, Sliders, Proofing WordPress plugin to version 4.5.0 or later
Audit existing WordPress accounts and remove or downgrade unused Contributor and higher roles
Review recent access logs for suspicious enumeration of the plugin's image endpoints

Patch Information

The vendor addressed CVE-2026-81652 in version 4.5.0 of the Photo Gallery, Sliders, Proofing WordPress plugin. The fix enforces ownership and capability checks on the affected image read path. Refer to the WPScan Vulnerability Report for advisory detail.

Workarounds

Restrict the Contributor role assignment until the plugin is patched
Deploy a web application firewall rule that blocks non-administrator sessions from the vulnerable endpoint
Temporarily deactivate the plugin on multi-author sites where upgrading is not immediately feasible

bash

# Upgrade the plugin via WP-CLI
wp plugin update photo-gallery --version=4.5.0
wp plugin list --name=photo-gallery --fields=name,status,version