Executive brief
The Picture Gallery plugin for WordPress, which is used to manage and display image galleries, contains a security flaw that allows users with 'Contributor' level access to delete arbitrary files from the web server. This could lead to a complete website outage if critical system files are removed, or it could be used to bypass security controls by deleting configuration files. Organizations using this plugin should update to version 1.6.6 immediately to prevent unauthorized data loss and service disruption.
Technical details
The VideoWhisper Picture Gallery plugin for WordPress (versions 1.6.5 and below) is vulnerable to arbitrary file deletion due to improper limitation of a pathname to a restricted directory (CWE-22). An authenticated attacker with Contributor-level privileges can exploit this path traversal vulnerability to delete files outside of the intended gallery directory. By sending a specially crafted request, an attacker can remove critical WordPress core files or configuration files, potentially leading to a denial-of-service condition or further system compromise. The issue is resolved in version 1.6.6.
Affected products
- VideoWhisper Picture Gallery <= 1.6.5
Timeline
- 2026-05-15: other: Vulnerability reported by researcher hhhai
- 2026-07-20: advisory: Patchstack published advisory
- 2026-07-23: disclosed: CVE published to NVD