CVE-2026-81650

HighCVSS 7.2/10Last modified Sep 21, 2026

Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
UnknownPhoto Gallery, Sliders, Proofing and Themes< 4.5.0

References

Timeline

Published
Sep 20, 2026
Last modified
Sep 21, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-816513.1The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing anCVE-2026-816522.7The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given imaCVE-2026-816534.2The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery iCVE-2026-816543.1The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saviCVE-2026-816557.5The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by everCVE-2026-816568.8IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged aCVE-2026-816579.8IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialiCVE-2026-816586.5A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template CVE-2026-816597.1Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that CVE-2026-81665.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. CVE-2026-816608.8The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to sCVE-2026-816628.6Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration valu