CVE-2026-105976: Portfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX Actions

Q: Which users can exploit this issue?

Any authenticated WordPress user with at least the Contributor role can exploit the affected AJAX actions. This includes contributors who should not normally be able to manage other users' galleries or site-wide gallery filters.

Q: What could an attacker do after exploiting it?

An eligible low-privileged user can read, modify, or delete galleries belonging to other users. They can also read, modify, or delete site-wide gallery filters.

Q: Are unauthenticated visitors affected?

The described attack requires a WordPress account with at least the Contributor role. The provided information does not indicate that unauthenticated visitors can exploit it.

Published Oct 10, 2026

Updated

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.

Affected Software

1 affected component

Portfolio Filter Gallery<2.2.1

Event History

Oct 10, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated WordPress user with at least the Contributor role can exploit the affected AJAX actions. This includes contributors who should not normally be able to manage other users' galleries or site-wide gallery filters.

What could an attacker do after exploiting it?

An eligible low-privileged user can read, modify, or delete galleries belonging to other users. They can also read, modify, or delete site-wide gallery filters.

Are unauthenticated visitors affected?

The described attack requires a WordPress account with at least the Contributor role. The provided information does not indicate that unauthenticated visitors can exploit it.