All vulnerabilities
CVE-2026-104645

Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR

Unknown Image Photo Gallery Final Tiles Grid
Open in ThreatlineRecord JSON
CVSS
2.7Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.6.14Fixed versionCVE List
Published8 Oct 2026Updated 8 Oct 2026CVE List

What fixes it

  • 3.6.14Image Photo Gallery Final Tiles GridCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.

Text from CVE List

Affected versions 1

  • Image Photo Gallery Final Tiles Gridaffected: all versions before 3.6.14CVE List

References 1