Alihan Şahin

**Name of the Vulnerable Software and Affected Versions** The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 **Description** The plugin fails to correctly validate file extensions when extracting files from an uploaded archive. This occurs because a variable is reused as a loop counter, causing the validation check to always pass. Consequently, users with the gallery-management capability can write arbitrary files into a web-accessible directory, which may lead to arbitrary code execution on hosts that execute these files. **Recommendations** Update the plugin to version 4.5.0 or later.