{"id":"CVE-2026-105976","title":"The Portfolio Filter Gallery  WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as wel…","summary":"The Portfolio Filter Gallery  WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as wel…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","cwe":["CWE-863"],"published":"2026-10-10","updated":"2026-10-13","sourceUpdated":"2026-10-13T20:36:00.850","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105976","references":[{"url":"https://wpscan.com/vulnerability/1ad36801-d53b-4253-ab7a-bd91c0f144f3/","label":"contact@wpscan.com"}],"tags":["nvd","cve.org"],"epss":0.0021,"epssPercentile":0.11097,"ingestedAt":"2026-10-10T06:24:42.862Z","product":"Portfolio Filter Gallery","affected":["portfolio_filter_gallery < 2.2.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-10T12:04:06.320619Z"},"slug":"CVE-2026-105976","body":"## Overview\n\nThe Portfolio Filter Gallery  WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":218840,"id":"CVE-2026-105976","ts":1791635586406,"field":"cvss","old":null,"new":"4.7"},{"seq":218839,"id":"CVE-2026-105976","ts":1791635586406,"field":"severity","old":"none","new":"medium"}]}