Vulnerabilities / Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery / WPSEC-2026-2818
Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.32 - Unauthenticated Sensitive Information Exposure via REST API Gallery Meta
Medium 5.3
CWE-200Fixed in 2.7.7.33
- ID
- WPSEC-2026-2818
- Plugin
- Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery (gt3-photo-video-gallery)
- Affected
- all versions before 2.7.7.33
- Remediation
- Update to 2.7.7.33 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery on WPSec AttackSurface
- Fix released
- Published
Description
The Photo Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7.32 via the REST API. The gallery post type's REST response includes the gallery image list, image count and attribute meta even for password-protected galleries. This makes it possible for unauthenticated attackers to retrieve the images of password-protected galleries without knowing the password.
References
- https://wpsec.com/vuln/WPSEC-2026-2818/
- https://plugins.svn.wordpress.org/gt3-photo-video-gallery/tags/2.7.7.33/
- https://wordpress.org/plugins/gt3-photo-video-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS