CVE-2026-104645
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Image Photo Gallery Final Tiles Grid WordPress plugin before version 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write plugin metadata onto arbitrary posts they do not own.
Risk Assessment
Unauthorized modifications to galleries and images can lead to content integrity violations, data corruption, and privilege escalation. The risk applies to installations with the Image Photo Gallery Final Tiles Grid plugin.
Recommendation
Update the Image Photo Gallery Final Tiles Grid plugin to version 3.6.14 or later, which includes a fix for authorization.
Other vulnerabilities in Image Photo Gallery Final Tiles Grid
See all- CVE-2026-104646Medium
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.
- CVE-2026-104409Medium
Stored XSS vulnerability in Image Photo Gallery Final Tiles Grid plugin up to version 3.6.13. Allows injection of a persistent script that can execute in the user's browser.
- CVE-2026-4559Medium
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-27424Medium
The Image Photo Gallery Final Tiles Grid WordPress plugin up to version 3.6.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-39510Low
The WordPress plugin Image Photo Gallery Final Tiles Grid (versions up to 3.6.11) contains an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS