CVE-2026-27424

MediumCVSS 4.3/10Last modified Jul 24, 2026

Description

Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.11.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
WP Chill	Image Photo Gallery Final Tiles Grid	<= 3.6.11

References

https://patchstack.com/database/wordpress/plugin/final-tiles-grid-gallery-lite/vulnerability/wordpress-image-photo-gallery-final-tiles-grid-plugin-3-6-11-broken-access-control-vulnerability?_s_id=cve

Timeline

Published: May 20, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-274257.1Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.CVE-2026-274267.1Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.CVE-2026-274276.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup allows Stored XS CVE-2026-274288.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eagle-Themes Eagle Booking eagle-booki CVE-2026-274299.8Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.CVE-2026-27439.8Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large fi CVE-2026-274307.1Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.CVE-2026-274325.4Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Acce CVE-2026-274336.5Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.CVE-2026-274345.3Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Securi CVE-2026-274355.3Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Control Security Levels. This issu CVE-2026-274369.1Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.