WordPress Plugin Vulnerabilities

Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail

Description

The plugin does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.

Proof of Concept

Affects Plugins

Plugin icon
portfolio-filter-gallery
Fixed in 2.2.1

References

CVE
CVE-2026-105977

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.2 (low)

Miscellaneous

Original Researcher
blast
Submitter
blast
Submitter twitter
Biner_1
Verified
Yes
WPVDB ID
6ad219b8-3633-4c54-a6cf-71cc0acf035e

Timeline

Publicly Published
2026-10-08 (about 2 days ago)
Added
2026-10-08 (about 1 day ago)
Last Updated
2026-10-08 (about 1 day ago)

Other

Published
Title
Published
2026-09-10
Title
Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR
Published
2026-03-05
Title
Subscription for WooCommerce – WordPress Recurring Payments Plugin < 1.8.11 - Authenticated (Customer+) Insecure Direct Object Reference
Published
2024-03-28
Title
ProfileGrid < 5.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-06-26
Title
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin < 1.1.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-02-03
Title
JS Help Desk – The Ultimate Help Desk & Support Plugin < 2.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference