CVE-2026-104645: Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Image Photo Gallery Final Tiles Grid WordPress pluginto a version that resolves this vulnerability.Fixed in 3.6.14
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access or higher can exploit it. Unauthenticated visitors are not described as able to use these actions.
What access does an attacker need to modify another user's galleries or images?
The attacker needs a valid account with at least Contributor privileges. They can target galleries and images belonging to other users because the plugin's authorization checks are missing or are performed against the wrong object.
Are WordPress sites affected by default?
Only sites using Image Photo Gallery Final Tiles Grid versions before 3.6.14 are identified as affected. Exploitation also requires that an attacker can authenticate with a Contributor-level or higher account.
What can an attacker do if successful?
They can clone, modify, and reorder other users' galleries and images. They can also write the plugin's metadata to arbitrary WordPress posts that they do not own.
How can administrators assess exposure?
Check whether Image Photo Gallery Final Tiles Grid is installed at a version earlier than 3.6.14, and review whether untrusted or unnecessary Contributor-or-higher accounts exist. Review gallery, image, and relevant post metadata changes for actions performed by accounts that did not own the affected content.