CVE-2026-81654 Photo Gallery, Sliders, Proofing and WordPress plugin CVE debrief

Who should care

Defenders responsible for WordPress installations with the Photo Gallery, Sliders, Proofing and plugin, especially those with multiple users or where users have been granted gallery-management capabilities, should assess exposure and prioritize remediation.

Why it matters

Defenders should care about CVE-2026-81654 because it allows users with limited capabilities to make site-wide changes, potentially impacting site security and integrity.

• Potential unauthorized changes to image sizing settings
• Possible elevation of privileges for users with gallery-management capabilities
• Required verification of plugin version and user capabilities
• Potential impact on site-wide settings

Technical summary

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not properly check user capabilities before allowing changes to image sizing settings, potentially allowing users with gallery-management capabilities to make site-wide changes. This vulnerability impacts site security and integrity, and defenders should prioritize verifying and remediating it in their WordPress installations, especially those with multiple users or where users have been granted gallery-management capabilities. The vulnerability is related to improper capability checks for image sizing settings, which can lead to unauthorized changes.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their WordPress installations, especially those with multiple users or where users have been granted gallery-management capabilities.

Recommended defensive actions

• Verify the version of the Photo Gallery, Sliders, Proofing and WordPress plugin is 4.5.0 or later
• Restrict gallery-management capabilities to trusted users
• Monitor for changes to image sizing settings
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, but indicate that it exists in the Photo Gallery, Sliders, Proofing and WordPress plugin before version 4.5.0. The vulnerability allows users with gallery-management capabilities to change image sizing settings site-wide. Defenders should verify plugin version, user capabilities, and monitor for changes to image sizing settings. Evidence is limited, and further verification is required to assess exposure and impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.