The vulnerability CVE-2026-22485 affects the My Album Gallery plugin by Ruhul Amin, specifically versions up to and including 1.0.4. It is characterized by missing authorization checks, which means that users with some level of privilege (PR:L) can perform unauthorized actions due to improperly configured access control. The CVSS 3.1 vector indicates network attack vector (AV:N), low attack complexity (AC:L), privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), high integrity impact (I:H), and no availability impact (A:N). This suggests an attacker with some privileges can modify data without authorization. No patch or official fix information is provided.

The impact is primarily on data integrity, as unauthorized users with limited privileges may modify data within the My Album Gallery plugin. There is no impact on confidentiality or availability. No known exploits in the wild have been reported, which may limit immediate risk but does not eliminate potential exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to the minimum necessary and monitor for suspicious activity related to the My Album Gallery plugin. Avoid granting unnecessary privileges that could be leveraged to exploit this missing authorization vulnerability.