CVE-2026-105977

Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.

Affected

Portfolio Filter Gallery

CVSS v3.1 CNA

2.2 LOWCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

EPSS

0.18% chance of exploitation in the next 30 days, 7th percentile

Published

2026-10-10

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6ad219b8-3633-4c54-a6cf-71cc0acf035e/

References

• CVE Record
• NVD entry