PT-2026-34854 · WordPress · Hm Books Gallery

Abhirup Konwar · Published 2026-04-24 · Updated 2026-04-25 · CVE-2026-5347

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HM Books Gallery versions prior to 4.8.1

Description The plugin is subject to missing authorization due to the absence of capability checks and nonce verification within the admin init hook. Specifically, the code at lines 205-209 of wp-books-gallery.php only verifies the presence of the permalink structure POST parameter before updating the wbg cpt slug option, failing to ensure the request originates from an authenticated administrator. This allows unauthenticated attackers to modify the custom post type slug for the books gallery, altering the URL structure for all book entries and potentially disrupting existing links and SEO rankings.

Recommendations Update to a version later than 4.8.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-5347

Affected Products

Hm Books Gallery

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-5347 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-books-gallery/trunk/wp-books-gallery.php#L206 · Note
• https://plugins.trac.wordpress.org/browser/wp-books-gallery/tags/4.7.8/wp-books-gallery.php#L207 · Note
• https://twitter.com/CVEnew/status/2048099314304532587 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-books-gallery/tags/4.8.1/wp-books-gallery.php#L207 · Note
• https://plugins.trac.wordpress.org/browser/wp-books-gallery/trunk/wp-books-gallery.php#L207 · Note
• https://plugins.trac.wordpress.org/browser/wp-books-gallery/tags/4.7.8/wp-books-gallery.php#L206 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/12bf1cd8-cd55-4771-b2bb-597797b1b949?source=cve · Note