Security Alert Summary
The Photo Gallery, Sliders, Proofing and WordPress plugin contains a vulnerability that can allow users granted its gallery-management capability to write arbitrary files to a web-accessible directory. A logic error reusing a loop counter causes an extension validation check to always pass, enabling file uploads that may be executed on hosts that run uploaded files.
CVE Details
- CVE ID: CVE-2026-81650
- Affected component: Photo Gallery, Sliders, Proofing and WordPress plugin
- Affected versions: Versions before 4.5.0 (less than 4.5.0)
- Published: September 20, 2026 at 7:16:49 AM UTC
- Last modified: September 20, 2026 at 2:16:55 PM UTC
- CVSS v3.1 base score: 7.2
- CVSS v3.1 severity: HIGH
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Authentication / privileges / user interaction: Privileges required: HIGH; User interaction: NONE; Attack vector: NETWORK; Attack complexity: LOW
- Impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- CWE: CWE-434 (Unrestricted Upload of File with Dangerous Type)
Technical Details
The vulnerability is caused by an incorrect validation routine for files extracted from an uploaded archive. A variable is reused as a loop counter so that the extension check always passes. As written, the check does not reliably prevent disallowed file types from being written to the filesystem.
Because users with the plugin’s gallery-management capability can upload archives, a permitted user can cause arbitrary files to be written into a web-accessible directory. On hosts configured to execute uploaded files, this may allow execution of arbitrary code. The description does not name specific functions or REST endpoints.
The impact is limited to what an attacker with the gallery-management capability can achieve on the affected site and host environment; it does not necessarily imply an immediate full site compromise on every installation, but it does permit file write and potential remote code execution under the conditions described.
How This Could Impact Your Website
Consider a site with a site owner, internal staff editors, and an external contributor or contractor who manages galleries. If an editor or a trusted contractor is granted the plugin’s gallery-management capability, they could upload an archive that bypasses extension checks and drops files into web-accessible directories. Those files could be used to host content that facilitates data exposure or to run code on servers that execute uploaded files.
Practical consequences include exposure of internal assets or data, increased risk of targeted phishing if files are used to harvest or display user information, and potential service disruption if malicious files are executed. If you reassign gallery-management capability broadly, the risk increases because more accounts could be leveraged to upload malicious files.
professional review: If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially gallery-management and contributor-level capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and restrict plugin installation to trusted administrators.
- Monitor site activity and file uploads for unusual behavior, and review web-accessible directories for unexpected files.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
