CVE-2026-104645: CWE-639 Authorization Bypass Through User-Controlled Key in Image Photo Gallery Final Tiles Grid
Description
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.
CVSS v3.1
Score 2.7low
Affected software
Image Photo Gallery Final Tiles Grid
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104645 is an authorization bypass vulnerability in the Image Photo Gallery Final Tiles Grid WordPress plugin versions prior to 3.6.14. The plugin fails to properly verify ownership during gallery and image management actions, either by checking ownership against the wrong object or omitting the check entirely. This flaw enables any authenticated user with contributor-level permissions or above to clone, modify, reorder galleries and images belonging to other users, and write plugin metadata onto posts they do not own.
Potential Impact
Authenticated users with contributor-level access or higher can manipulate galleries and images of other users, potentially leading to unauthorized content modification and metadata injection on arbitrary posts. This could affect content integrity and user trust within the affected WordPress site.
Mitigation Recommendations
Upgrade the Image Photo Gallery Final Tiles Grid plugin to version 3.6.14 or later where this authorization bypass vulnerability is fixed. No other mitigation guidance is provided; patching is the recommended action.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-02T05:40:33.815Z
- State
- PUBLISHED
Threat ID: 6ac735da2cdf04f656f03e9f
Added to database: 10/08/2026, 06:19:06 UTC
Last enriched: 10/08/2026, 06:34:23 UTC
Last updated: 10/08/2026, 18:48:43 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.