# CVE-2026-57696: VideoWhisper Picture Gallery arbitrary file deletion via path traversal

Source: https://junglewise.ai/threats/cve-2026-57696-videowhisper-picture-gallery-arbitrary-file-deletion-via-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-57696 · Severity: high · CVSS 7.1 · Published 2026-07-23

The Picture Gallery plugin for WordPress, which is used to manage and display image galleries, contains a security flaw that allows users with 'Contributor' level access to delete arbitrary files from the web server. This could lead to a complete website outage if critical system files are removed, or it could be used to bypass security controls by deleting configuration files. Organizations using this plugin should update to version 1.6.6 immediately to prevent unauthorized data loss and service disruption.

Vendors: [VideoWhisper](https://junglewise.ai/threats/vendors/videowhisper).

## Quick answers

**Is CVE-2026-57696 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57696 being exploited in the wild.

**How severe is CVE-2026-57696?** High severity, with a CVSS score of 7.1, published 23 July 2026.

**Which products and versions are affected?** VideoWhisper Picture Gallery <= 1.6.5.

**Is there a fix for CVE-2026-57696?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57696 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57696?** Check whether you run VideoWhisper Picture Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The VideoWhisper Picture Gallery plugin for WordPress (versions 1.6.5 and below) is vulnerable to arbitrary file deletion due to improper limitation of a pathname to a restricted directory (CWE-22). An authenticated attacker with Contributor-level privileges can exploit this path traversal vulnerability to delete files outside of the intended gallery directory. By sending a specially crafted request, an attacker can remove critical WordPress core files or configuration files, potentially leading to a denial-of-service condition or further system compromise. The issue is resolved in version 1.6.6.

## Affected products

- VideoWhisper Picture Gallery <= 1.6.5

## Timeline

- 2026-05-15: other: Vulnerability reported by researcher hhhai
- 2026-07-20: advisory: Patchstack published advisory
- 2026-07-23: disclosed: CVE published to NVD

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/picture-gallery/vulnerability/wordpress-picture-gallery-plugin-1-6-5-arbitrary-file-deletion-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/picture-gallery/vulnerability/wordpress-picture-gallery-plugin-1-6-5-arbitrary-file-deletion-vulnerability?_s_id=cve)

## Related threats

- [videowhisper Picture Gallery stored XSS in Access Control settings](https://junglewise.ai/threats/cve-2021-47951-videowhisper-picture-gallery-stored-xss-in-access-control)