rootpwn

medium · CVSS v3 2.7 · EPSS 0.00132

CVE-2026-81652

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entit…

Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.

Scores

Severity
medium
CVSS v2
4
CVSS v3
2.7
CVSS v4
—
EPSS
0.00132

← All CVEs

Related CVEs

medium

CVE-2026-94032

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

View analysis

medium

CVE-2026-93956

A medium‑severity XSS flaw exists in olivier-ls PHP‑FTS up to 1.1.2. The vulnerability is triggered by manipulating the Query argument to SearchEngine::buildHighlights, allowing remote attackers to inject malicious scripts. It can be exploited via a web request to the affected component.

View analysis

medium

CVE-2026-92410

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.

View analysis

medium

CVE-2026-92422

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.

View analysis