Vulnerabilities / Visual Portfolio, Photo Gallery & Post Grid / WPSEC-2026-1641
Visual Portfolio, Photo Gallery & Post Grid <= 3.8.2 - Authenticated (Subscriber+) Sensitive Information Exposure via Gallery Preview
Medium 4.3
CWE-200Fixed in 3.9.0
- ID
- WPSEC-2026-1641
- Plugin
- Gallery by Visual Portfolio (visual-portfolio)
- Affected
- all versions before 3.9.0
- Remediation
- Update to 3.9.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-25
- Attack surface
- Visual Portfolio, Photo Gallery & Post Grid on WPSec AttackSurface
- Fix released
- Published
Description
The Gallery by Visual Portfolio plugin for WordPress is vulnerable to Sensitive Information Exposure via the gallery preview frame in all versions up to, and including, 3.8.2, due to the preview only verifying a nonce that is printed on every admin page, without checking that the user can edit content, and rendering a gallery from posted attributes, including a custom query, without limiting post statuses. This makes it possible for authenticated attackers, with subscriber-level access and above, to render galleries that show the titles, excerpts and images of other users' draft and private posts.
References
- https://wpsec.com/vuln/WPSEC-2026-1641/
- https://plugins.svn.wordpress.org/visual-portfolio/tags/3.9.0/
- https://wordpress.org/plugins/visual-portfolio/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS