The Gallery Blocks with Lightbox plugin allows the AJAX handler used for updating options to check only for the edit_posts capability, rather than the higher manage_options capability required for changing plugin settings. Consequently, any authenticated user with Contributor level access or higher can call the update action and set arbitrary settings that begin with pgc_sgb_ through the plugin’s UI. This flaw does not provide direct code execution, but it does allow the attacker to alter configuration values that may affect how media galleries are rendered or how lightbox functionality behaves.

The vulnerability affects Mixed Media Gallery Blocks by gallerycreator, in all plugin releases up to and including version 3.3.0. Users running any of those versions are at risk unless they upgrade the plugin beyond 3.3.0.

The CVSS score is 4.3, indicating a moderate impact. The EPSS score of less than 1% suggests the likelihood of exploitation is very low at present. The flaw is not listed in the CISA KEV catalog, so there is no known active exploitation, but authenticated users of sufficient privilege can exploit the missing authorization check. PoC requires an AJAX request authenticated under Contributor or higher and the capability to modify pgc_sgb_* options in the database.