# Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.32 - Unauthenticated Sensitive Information Exposure via REST API Gallery Meta

- **ID:** WPSEC-2026-2818
- **Plugin:** Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery (`gt3-photo-video-gallery`), https://wordpress.org/plugins/gt3-photo-video-gallery/
- **Affected versions:** all versions before 2.7.7.33
- **Fixed in:** 2.7.7.33 (Update to 2.7.7.33 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/gt3-photo-video-gallery
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2818/

## Description

The Photo Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7.32 via the REST API. The gallery post type's REST response includes the gallery image list, image count and attribute meta even for password-protected galleries. This makes it possible for unauthenticated attackers to retrieve the images of password-protected galleries without knowing the password.

## References

- https://wpsec.com/vuln/WPSEC-2026-2818/
- https://plugins.svn.wordpress.org/gt3-photo-video-gallery/tags/2.7.7.33/
- https://wordpress.org/plugins/gt3-photo-video-gallery/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2818/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.