CVE-2026-1036
📋 TL;DR
This vulnerability in the Photo Gallery by 10WordPress plugin allows unauthenticated attackers to delete arbitrary image comments due to missing capability checks. Only users of the Pro version with comments functionality enabled are affected, but all versions up to 1.8.36 are vulnerable.
💻 Affected Systems
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete all image comments, disrupting user engagement and potentially removing important feedback or moderation content.
Likely Case
Spammers or malicious actors delete legitimate comments to disrupt gallery functionality or remove evidence of previous malicious activity.
If Mitigated
Minimal impact if comments are not critical to operations or if proper backups exist.
🎯 Exploit Status
Simple HTTP request manipulation can trigger the vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.37 or later
Vendor Advisory: https://wordpress.org/plugins/photo-gallery/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Photo Gallery by 10Web'. 4. Click 'Update Now' if available. 5. If no update appears, download version 1.8.37+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Comments
allTemporarily disable comments functionality in the plugin settings
Deactivate Plugin
allDeactivate the plugin until patched
🧯 If You Can't Patch
- Implement web application firewall rules to block unauthorized DELETE requests to gallery endpoints
- Restrict access to the WordPress admin area using IP whitelisting
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is 1.8.36 or lower and Pro version with comments enabled, system is vulnerable.Check Version:
wp plugin get photo-gallery --field=version (if WP-CLI installed)Verify Fix Applied:
Confirm plugin version is 1.8.37 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual DELETE requests to /wp-admin/admin-ajax.php with action=bwg_delete_comment
- Multiple comment deletions from unauthenticated IPs
Network Indicators:
- HTTP POST requests to admin-ajax.php with delete_comment parameters from external IPs
SIEM Query:
source="wordpress.log" AND "bwg_delete_comment" AND status=200 AND NOT user_agent="WordPress/*"