CVE-2026-105976

MediumCVSS 4.7

Published: 10/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 10/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.

Risk Assessment

Users with lower privileges can access and modify other users' galleries, potentially leading to confidentiality, integrity, and availability breaches.

Recommendation

Update the Portfolio Filter Gallery plugin to version 2.2.1 or later, which includes the security fix.

Other vulnerabilities in Portfolio Filter Gallery

CVE-2026-105977Low
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS