CVE-2026-81652: CWE-639 Authorization Bypass Through User-Controlled Key in Photo Gallery, Sliders, Proofing and Themes
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.
AI Analysis
Technical Summary
CVE-2026-81652 is an authorization bypass vulnerability (CWE-639) in the Photo Gallery, Sliders, Proofing and Themes WordPress plugin versions 3.59.5 up to but not including 4.5.0. The plugin fails to verify that the requesting user has permission to access a given image record, allowing users with Contributor role or higher to read stored metadata of any image on the site, including those belonging to other users. The exposed metadata includes EXIF information and internal checksums and identifiers normally restricted to administrators.
Potential Impact
Users with Contributor role and above can access sensitive image metadata across the site without proper authorization. This unauthorized disclosure could lead to privacy concerns or information leakage about images and their origins. However, the vulnerability does not allow modification or deletion of images, only unauthorized reading of metadata.
Mitigation Recommendations
Upgrade the Photo Gallery, Sliders, Proofing and Themes plugin to version 4.5.0 or later where this authorization bypass vulnerability is fixed. No other mitigation or temporary workaround is indicated.
CVE-2026-81652: CWE-639 Authorization Bypass Through User-Controlled Key in Photo Gallery, Sliders, Proofing and Themes
Description
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.
CVSS v3.1
Score 2.7low
Affected software
Photo Gallery, Sliders, Proofing and Themes
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-81652 is an authorization bypass vulnerability (CWE-639) in the Photo Gallery, Sliders, Proofing and Themes WordPress plugin versions 3.59.5 up to but not including 4.5.0. The plugin fails to verify that the requesting user has permission to access a given image record, allowing users with Contributor role or higher to read stored metadata of any image on the site, including those belonging to other users. The exposed metadata includes EXIF information and internal checksums and identifiers normally restricted to administrators.
Potential Impact
Users with Contributor role and above can access sensitive image metadata across the site without proper authorization. This unauthorized disclosure could lead to privacy concerns or information leakage about images and their origins. However, the vulnerability does not allow modification or deletion of images, only unauthorized reading of metadata.
Mitigation Recommendations
Upgrade the Photo Gallery, Sliders, Proofing and Themes plugin to version 4.5.0 or later where this authorization bypass vulnerability is fixed. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-27T09:27:34.936Z
- State
- PUBLISHED
Threat ID: 6aaf7de855bf5e2cf5adcf95
Added to database: 09/20/2026, 06:32:08 UTC
Last enriched: 09/20/2026, 06:47:34 UTC
Last updated: 09/21/2026, 00:27:43 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.