CVE-2026-81653
Received Received - Intake

Unauthorized Image Deletion in Photo Gallery WordPress Plugin

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: WPScan

Description
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-81653
EUVD
EUVD-2026-83665

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
photo_gallery wordpress_plugin to 4.5.0 (exc)
nextgen_gallery nextgen_gallery to 4.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in the Photo Gallery, Sliders, Proofing WordPress plugin before version 4.5.0. It allows users with gallery-management capabilities to delete, copy, or re-tag any image on the site, even if those images belong to other users. The plugin fails to verify that the user owns the gallery containing the image before allowing modifications.

Detection Guidance

Check the installed version of the NextGEN Gallery plugin. If it is below 4.5.0, the system is vulnerable. Use WordPress admin panel or run: wp plugin list | grep nextgen-gallery in the WordPress root directory.

Impact Analysis

If you use this plugin with versions prior to 4.5.0, an attacker with gallery-management permissions could delete, copy, or re-tag your images without your consent. This could lead to data loss, unauthorized duplication of images, or misattribution of content. The impact depends on the sensitivity of the images stored in galleries.

Compliance Impact

This vulnerability could potentially violate compliance requirements such as GDPR or HIPAA if it leads to unauthorized access or modification of sensitive data like personal images or medical photos. Organizations may face legal consequences if they fail to protect user data adequately.

Mitigation Strategies

Update the NextGEN Gallery plugin to version 4.5.0 or later immediately. Remove or restrict gallery-management capabilities from untrusted users until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81653. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart