CVE-2026-104645 Image Photo Gallery Final Tiles Grid CVE debrief

Who should care

WordPress site administrators and defenders responsible for managing plugins and user access controls should assess exposure and apply patches. They should also review access controls to prevent exploitation and monitor for unusual activity related to gallery and image management on WordPress sites using the plugin. Prioritization of patching and review of contributor and higher-level access controls is crucial to prevent unauthorized actions on galleries

Why it matters

CVE-2026-104645 is an authorization bypass vulnerability in the Image Photo Gallery Final Tiles Grid plugin, allowing contributors and above to perform unauthorized actions on galleries and images. Defenders should prioritize patching and review access controls.

• Defenders must verify and apply patches to prevent unauthorized gallery and image modifications.
• Contributor-level access controls require review to prevent exploitation.
• Monitoring for unusual activity related to gallery and image management is necessary.

Technical summary

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization for gallery and image management actions, allowing contributors and above to perform unauthorized actions. This vulnerability is caused by inadequate checks in the plugin's authorization process, enabling contributors and users with higher access levels to clone, modify, and reorder galleries and images belonging to other users, as well as update metadata on arbitrary posts. Defenders should prioritize verifying exposure and applying patches for the Image Photo Gallery Final Tiles Grid plugin, focusing on contributor and higher-level access controls.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for the Image Photo Gallery Final Tiles Grid plugin, focusing on contributor and higher-level access controls.

Recommended defensive actions

• Verify and apply the patch to update the Image Photo Gallery Final Tiles Grid plugin to version 3.6.14 or later.
• Restrict contributor and higher-level access to sensitive WordPress functionality.
• Monitor for unusual gallery and image management activity on WordPress sites using the plugin.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the authorization bypass vulnerability in the Image Photo Gallery Final Tiles Grid plugin. Specific exploit details and impact are limited, but defenders should verify and apply patches to prevent unauthorized gallery and image modifications. The vulnerability has been publicly disclosed, and defenders should review access controls and monitor for unusual activity related to gallery and image management. Evidence is based on CVE and source item descriptions, with limitations in exploit

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.