CVE-2026-105977

2.2 Faible

Publiée le 10/10/2026 à 08:16 · Modifiée le 13/10/2026 à 22:36 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.

Traduire en français

Produits concernés

Unknown Portfolio Filter Gallery

Scores CVSS

Version	Score	Source	Vecteur
3.1	2.2 Faible	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-639

Références

https://wpscan.com/vulnerability/6ad219b8-3633-4c54-a6cf-71cc0acf035e/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories