Description
Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
Published: 2026-07-23
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an attacker to delete arbitrary files on the host system where the WordPress Picture Gallery plugin is installed. This weakness, classified as CWE‑22, compromises file integrity and can disrupt service availability, as critical files or configuration data may be removed.

Affected Systems

WordPress sites running the Picture Gallery plugin (videowhisper) version 1.6.5 or earlier.

Risk and Exploitability

The CVSS score of 7.1 indicates a high impact severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation currently. The attack vector is not explicitly stated; it is inferred that success requires the attacker to act as a plugin contributor or otherwise gain write access to the plugin directory. The vulnerability is not listed in CISA’s KEV catalog, further indicating limited current exploitation activity.

Generated by OpenCVE AI on August 3, 2026 at 22:28 UTC.

Remediation

Vendor Solution

Update the WordPress Picture Gallery Plugin to the latest available version (at least 1.6.6).

OpenCVE Recommended Actions

  • Update the Picture Gallery plugin to version 1.6.6 or later to remove the deletion logic.
  • Set restrictive write permissions on the WordPress plugins directory so that only trusted administrators can modify files.
  • Configure filesystem monitoring to alert on unexpected file deletion events within the WordPress installation.

Generated by OpenCVE AI on August 3, 2026 at 22:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Videowhisper
Videowhisper picture Gallery
Wordpress
Wordpress wordpress
Vendors & Products Videowhisper
Videowhisper picture Gallery
Wordpress
Wordpress wordpress

Thu, 23 Jul 2026 11:45:00 +0000

Type Values Removed Values Added
Description Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
Title WordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerability
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

Videowhisper Picture Gallery
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-23T16:01:48.198Z

Reserved: 2026-06-25T08:03:50.157Z

Link: CVE-2026-57696

cve-icon Vulnrichment

Updated: 2026-07-23T16:01:44.901Z

cve-icon NVD

Status : Deferred

Published: 2026-07-23T12:18:29.180

Modified: 2026-07-23T16:17:27.507

Link: CVE-2026-57696

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T22:30:03Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')