CVE-2026-105977: Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail

Q: Which users can exploit this issue?

Authenticated WordPress users with the Contributor role or higher can exploit it. The flaw allows them to delete certain media attachments owned by other users, including administrators.

Q: What does an attacker need to do to exploit it?

The attacker needs an account with at least Contributor privileges and must invoke the pfg_delete_video_thumbnail functionality against a target attachment. No per-object authorization check prevents deletion of attachments owned by other users.

Q: Are media files deleted permanently?

Yes. The affected functionality can permanently delete certain media attachments, so recovery may depend on available backups or other external retention mechanisms.

Q: What version resolves the issue?

Upgrade to version 2.2.1 or later. Versions from 2.0.2 through 2.2.0 are identified as affected.

Published Oct 10, 2026

Updated

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.

Affected Software

1 affected component

Portfolio Filter Gallery Portfolio Filter Gallery WordPress plugin<2.2.1

Event History

Oct 10, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Which users can exploit this issue?

Authenticated WordPress users with the Contributor role or higher can exploit it. The flaw allows them to delete certain media attachments owned by other users, including administrators.

What does an attacker need to do to exploit it?

The attacker needs an account with at least Contributor privileges and must invoke the pfg_delete_video_thumbnail functionality against a target attachment. No per-object authorization check prevents deletion of attachments owned by other users.

Are media files deleted permanently?

Yes. The affected functionality can permanently delete certain media attachments, so recovery may depend on available backups or other external retention mechanisms.

What version resolves the issue?

Upgrade to version 2.2.1 or later. Versions from 2.0.2 through 2.2.0 are identified as affected.

CVE-2026-105977: Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

What does an attacker need to do to exploit it?

Are media files deleted permanently?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What does an attacker need to do to exploit it?

Are media files deleted permanently?

What version resolves the issue?