CVE-2026-81654 Overview
CVE-2026-81654 is a broken access control vulnerability in the Photo Gallery, Sliders, Proofing WordPress plugin versions before 4.5.0. The plugin fails to verify that a user holds the required options capability before saving image sizing settings. Users granted only the gallery-management capability by an administrator can modify configuration that applies across the entire site. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Low-privileged gallery managers can alter site-wide image sizing settings, exceeding the authorization scope intended by administrators.
Affected Products
- Photo Gallery, Sliders, Proofing WordPress plugin versions before 4.5.0
- WordPress sites where the plugin is installed and gallery-management capability has been delegated
- Multi-user WordPress deployments relying on capability separation for the plugin
Discovery Timeline
- 2026-09-20 - CVE-2026-81654 published to the National Vulnerability Database
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-81654
Vulnerability Analysis
The vulnerability is a broken access control issue in the plugin's settings save handler. The plugin defines two distinct capabilities: an options capability for administrative configuration and a gallery-management capability delegated to lower-privileged users. The image sizing settings handler checks only that a request is authenticated and originates from a user with gallery-management rights. It does not enforce the options capability required to modify site-wide settings.
A user granted gallery-management can submit the settings form and change values that alter image handling for every gallery on the site. The impact is limited to integrity of configuration data. Confidentiality and availability are not directly affected. The attacker must already hold a valid low-privileged account, which limits exploitation to insider or post-compromise scenarios.
Root Cause
The root cause is a missing capability check in the settings save function. The plugin author scoped the endpoint to the gallery-management capability but did not add a secondary current_user_can() check for the options capability before persisting image sizing values. This aligns with the CWE-639 pattern where authorization is scoped to one resource type but reused to modify a broader resource.
Attack Vector
Exploitation requires an authenticated session with the gallery-management capability. The attacker submits a crafted POST request to the plugin's settings endpoint with modified image sizing parameters. No user interaction from an administrator is required. The change applies globally and persists until an administrator reviews and corrects the settings. See the WPScan Vulnerability Report for further technical detail.
Detection Methods for CVE-2026-81654
Indicators of Compromise
- Unexpected changes to plugin image sizing settings in the WordPress wp_options table
- POST requests to the plugin settings endpoint originating from non-administrator accounts
- Audit log entries showing settings modifications by users lacking the options capability
Detection Strategies
- Review WordPress activity logs for settings modifications performed by gallery-management users
- Compare current plugin option values against a known-good baseline after each change window
- Correlate HTTP request logs with WordPress user roles to flag privilege boundary violations
Monitoring Recommendations
- Enable WordPress audit logging for capability-scoped actions and option updates
- Alert on modifications to plugin settings performed by non-administrator sessions
- Track plugin version across managed WordPress sites to confirm patch status
How to Mitigate CVE-2026-81654
Immediate Actions Required
- Update the Photo Gallery, Sliders, Proofing plugin to version 4.5.0 or later
- Audit which user accounts hold the gallery-management capability and remove where unnecessary
- Review current plugin image sizing settings for unauthorized changes and restore correct values
Patch Information
The vendor addressed the issue in version 4.5.0 by adding a capability check that requires the options capability before saving image sizing settings. Site administrators should apply the update through the WordPress plugin management interface. Refer to the WPScan Vulnerability Report for the referenced fix.
Workarounds
- Restrict the gallery-management capability to trusted users only until the patch is applied
- Deploy a web application firewall rule to block settings-endpoint requests from non-administrator roles
- Temporarily revoke the plugin's settings page for delegated users through a role-management plugin
# Update the affected plugin using WP-CLI
wp plugin update photo-gallery --version=4.5.0
wp plugin get photo-gallery --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
