Photo Gallery by 10Web – Mobile-Friendly Image Gallery, CVE-2026-1036
- CVE, Research URL
- Published on
- Jan 22, 2026
- Research Description
- The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_comment() function in all versions up to, and including, 1.8.36. This makes it possible for unauthenticated attackers to delete arbitrary image comments. Note: comments functionality is only available in the Pro version of the plugin.
- Affected versions
-
max 1.8.37.
- Status
-
vulnerable