CVE-2026-105977 Portfolio Filter Gallery CVE debrief

Who should care

Defenders responsible for WordPress site security, particularly those with multiple contributors or users with elevated roles, should assess exposure and prioritize remediation to prevent unauthorized deletions and potential disruptions to content management. Security teams and operators managing WordPress installations should review and verify affected versions to ensure remediation and monitor for suspicious activity.

Why it matters

CVE-2026-105977 allows contributors to delete media attachments of other users, potentially disrupting content management on WordPress sites.

• Potential unauthorized deletion of media attachments by contributors or users with elevated roles.
• Possible disruption to content and media management on the WordPress site.
• Need for verification of affected versions and remediation to prevent exploitation.

Technical summary

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators. This vulnerability can be exploited by users with elevated roles, potentially disrupting content and media management on the WordPress site. Defenders should prioritize verifying and remediating this vulnerability in their WordPress installations.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their WordPress installations, especially those with multiple contributors or users with elevated roles.

Recommended defensive actions

• Verify the version of the Portfolio Filter Gallery plugin and update to 2.2.1 or later if necessary.
• Restrict the roles that can delete media attachments to prevent unauthorized deletions.
• Monitor for suspicious deletion activity on the WordPress site.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information from the vendor and other sources may be necessary to fully understand the impact and remediation. The source item and CVE Program record offer initial insights, but further verification is required to assess affected versions and ensure remediation. The official CVE Program record and NVD detail page provide source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.