CVE-2026-81650

Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0

Description The plugin fails to correctly validate file extensions when extracting files from an uploaded archive. This occurs because a variable is reused as a loop counter, causing the validation check to always pass. Consequently, users with the gallery-management capability can write arbitrary files into a web-accessible directory, which may lead to arbitrary code execution on hosts that execute these files.

Recommendations Update the plugin to version 4.5.0 or later.