Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.2 - Authenticated (Contributor+) Path Traversal to Arbitrary File Read via 'importFiles' Parameter
- ID
- WPSEC-2026-1403
- Plugin
- Picture Gallery – Frontend Image Uploads, AJAX Photo List (picture-gallery)
- Affected
- all versions before 1.7.21
- Remediation
- Update to 1.7.21 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- Picture Gallery – Frontend Image Uploads, AJAX Photo List on WPSec AttackSurface
- Fix released
- Published
Description
The Picture Gallery plugin for WordPress is vulnerable to Path Traversal via the 'importFiles' parameter of the picture import form (videowhisper_picture_import shortcode) in all versions up to, and including, 1.6.2. This is due to submitted file names not being sanitized before they are joined to the import folder path, and the import folder (the shortcode's 'path' attribute) not being limited to the configured import directory. This makes it possible for authenticated attackers, with Contributor-level access and above (the plugin's default sharing roles), to copy arbitrary files from the server into the plugin's public uploads directory as published pictures and then read their contents, which may expose sensitive information.
References
- https://wpsec.com/vuln/WPSEC-2026-1403/
- https://plugins.svn.wordpress.org/picture-gallery/tags/1.7.21/
- https://wordpress.org/plugins/picture-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS