Description
The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admin_init hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php. The vulnerable code checks only for the presence of the 'permalink_structure' POST parameter before updating the 'wbg_cpt_slug' option, without verifying that the request comes from an authenticated administrator. This makes it possible for unauthenticated attackers to modify the custom post type slug for the books gallery, which changes the URL structure for all book entries and can break existing links and SEO rankings.
Published: 2026-04-24
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Configuration Change
Action: Apply Patch
AI Analysis

Impact

The WP Books Gallery plugin for WordPress contains a missing authorization flaw in versions up to 4.8.0. The admin_init hook that processes permalink settings updates only checks for the presence of the 'permalink_structure' POST parameter and neglects to verify the caller's administrative capability or a valid nonce. As a result, an unauthenticated user can submit a POST request to the settings page and change the 'wbg_cpt_slug' option. Modifying this value alters the URL structure for all book entries, breaking existing links and hurting SEO, and undermines the integrity of the site's configuration.

Affected Systems

The vulnerability exists in the WP Books Gallery plugin by mhmrajib, titled 'WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes'. Versions 4.0.0 through 4.8.0 inclusive are affected; any installations running those versions are at risk. Newer releases such as 4.8.1 contain the fix.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score of <1% suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need only to craft an unauthenticated HTTP POST containing the 'permalink_structure' field and target the plugin’s settings endpoint; no privileged access is required. The resulting impact could disrupt site navigation and degrade SEO, but it does not grant direct access to the underlying filesystem or data.

Generated by OpenCVE AI on April 28, 2026 at 20:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the WP Books Gallery plugin to version 4.8.1 or later.
  • Configure a web application firewall or web‑server rule to deny unauthenticated POST requests to the plugin’s settings endpoint, preventing the 'permalink_structure' parameter from being processed.
  • If upgrading or firewall configuration is not possible, temporarily disable the plugin by renaming its folder or otherwise removing it from the plugins directory until the fix is applied.

Generated by OpenCVE AI on April 28, 2026 at 20:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Mhmrajib
Mhmrajib wp Books Gallery – Build Stunning Book Showcases & Libraries In Minutes
Wordpress
Wordpress wordpress
Vendors & Products Mhmrajib
Mhmrajib wp Books Gallery – Build Stunning Book Showcases & Libraries In Minutes
Wordpress
Wordpress wordpress

Fri, 24 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 24 Apr 2026 06:00:00 +0000

Type Values Removed Values Added
Description The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admin_init hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php. The vulnerable code checks only for the presence of the 'permalink_structure' POST parameter before updating the 'wbg_cpt_slug' option, without verifying that the request comes from an authenticated administrator. This makes it possible for unauthenticated attackers to modify the custom post type slug for the books gallery, which changes the URL structure for all book entries and can break existing links and SEO rankings.
Title WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Mhmrajib Wp Books Gallery – Build Stunning Book Showcases & Libraries In Minutes
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-24T12:03:11.676Z

Reserved: 2026-04-01T16:35:44.962Z

Link: CVE-2026-5347

cve-icon Vulnrichment

Updated: 2026-04-24T12:03:07.898Z

cve-icon NVD

Status : Deferred

Published: 2026-04-24T06:16:04.913

Modified: 2026-04-24T14:38:26.740

Link: CVE-2026-5347

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T20:30:06Z

Weaknesses