CVE-2026-27424

Vulnerability

The Image Photo Gallery Final Tiles Grid plugin for WordPress versions through 3.6.11 contains a missing authorization vulnerability [1]. The plugin fails to properly check access control, allowing unauthenticated or low-privileged users to trigger functions that should require higher privileges.

Exploitation

An attacker with network access to a WordPress site running the vulnerable plugin can exploit this by sending a crafted request to a vulnerable endpoint without proper authorization checks [1]. No authentication is required, making the attack trivial to execute.

Impact

Successful exploitation allows an unprivileged attacker to perform actions normally restricted to higher privileged roles, such as modifying plugin settings or gallery content. The impact is considered low severity, but the vulnerability could be used in mass-exploit campaigns [1].

Mitigation

Update to version 3.6.12 or later, which contains the fix for this vulnerability [1]. For Patchstack users, enabling auto-update for vulnerable plugins is recommended. No workarounds are available besides updating.