CVE-2026-39510

LowCVSS 2.7

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

11th percentile - higher than 11% of all known CVEs

Summary

The WordPress plugin Image Photo Gallery Final Tiles Grid (versions up to 3.6.11) contains an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker can gain unauthorized access to protected functions or data, potentially leading to data leakage or privilege escalation.

Recommendation

Immediately update the Image Photo Gallery Final Tiles Grid plugin to the latest version (above 3.6.11).

Original NVD description (English source)

Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.11.