PT-2026-3881 · WordPress · Photo Gallery By 10Web – Mobile-Friendly Image Gallery+1

Moose Love · Publicado 2026-01-21 · Atualizado 2026-01-22 · CVE-2026-1036

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions through 1.8.36

Description The software is susceptible to unauthorized data modification. A missing capability check within the delete comment() function allows unauthenticated attackers to delete arbitrary image comments. This issue is present in the Pro version of the plugin, where the comments functionality is enabled.

Recommendations Update the plugin to a version beyond 1.8.36.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1036

Produtos afetados

10Web – Mobile-Friendly Image Gallery

Photo Gallery By 10Web – Mobile-Friendly Image Gallery

Referências · 6

• https://t.me/cveNotify/149495 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-1036 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.35/frontend/controllers/BWGControllerGalleryBox.php#L173 · Nota
• https://twitter.com/lsof/status/2014166750040830356 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/4eb2ae42-584d-4da8-9184-461b5a37b7b6?source=cve · Nota
• https://twitter.com/CVEnew/status/2014125837398819100 · Publicação no Twitter