CVE-2026-104645
Received Received - Intake

Authorization Bypass in Image Photo Gallery Final Tiles Grid WordPress Plugin

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: WPScan

Description
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-104645
EUVD
EUVD-2026-94763

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Image Photo Gallery Final Tiles Grid 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in the Image Photo Gallery Final Tiles Grid WordPress plugin affecting versions before 3.6.14. It allows authenticated users with contributor-level access or higher to perform unauthorized actions like cloning, modifying, or reordering galleries and images belonging to other users. The plugin fails to properly verify authorization, either checking ownership against the wrong object or omitting the check entirely.

Detection Guidance

Check if the Image Photo Gallery Final Tiles Grid plugin is installed and verify its version. If the version is below 3.6.14, the system is vulnerable. Look for unauthorized changes to galleries, images, or plugin metadata on posts.

Impact Analysis

An attacker with contributor-level access or higher could modify or reorder your galleries and images without permission. They could also update plugin metadata on posts they do not own, potentially altering content or metadata associated with your site.

Compliance Impact

This vulnerability could lead to unauthorized modifications of user data, potentially violating GDPR's data integrity principles or HIPAA's requirements for protecting sensitive health information. Unauthorized changes to content or metadata may result in non-compliance with these regulations.

Mitigation Strategies

Update the Image Photo Gallery Final Tiles Grid plugin to version 3.6.14 or later immediately. Review all galleries, images, and posts for unauthorized modifications and revert any changes if found.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104645. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart