{
 "id": "WPSEC-2026-2818",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2818/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2818/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2818/index.md",
 "title": "Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.32 - Unauthenticated Sensitive Information Exposure via REST API Gallery Meta",
 "description": "The Photo Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7.32 via the REST API. The gallery post type's REST response includes the gallery image list, image count and attribute meta even for password-protected galleries. This makes it possible for unauthenticated attackers to retrieve the images of password-protected galleries without knowing the password.",
 "plugin": {
  "slug": "gt3-photo-video-gallery",
  "name": "Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery",
  "full_name": "Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery",
  "wordpress_org": "https://wordpress.org/plugins/gt3-photo-video-gallery/",
  "advisories_url": "https://wpsec.com/vuln/plugin/gt3-photo-video-gallery/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/gt3-photo-video-gallery"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.7.7.33",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.7.7.33"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.7.7.33",
 "remediation": "Update to 2.7.7.33 or later.",
 "fix_released": "2026-11-09T15:22:43+00:00",
 "published": "2026-11-10T15:48:02+00:00",
 "updated": "2026-11-09T23:34:25.012824+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2818/",
  "https://plugins.svn.wordpress.org/gt3-photo-video-gallery/tags/2.7.7.33/",
  "https://wordpress.org/plugins/gt3-photo-video-gallery/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/gt3-photo-video-gallery",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}