Vulnerability · Published Sep 20, 2026 · Assigned by WPScan

CVE-2026-81653NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR

Medium 4.2

In plain English

A medium-severity authorization bypass via user-controlled key in Photo Gallery, Sliders, Proofing and Themes from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.2%top 91.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Photo Gallery, Sliders, Proofing and Themes	0 – before 4.5.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/0bceb61b-6986-4669-896c-4279ecef0603/ exploit, vdb-entry, technical-description