What the vulnerability does
01Description
The Grid Gallery – Photo Image Grid Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization via shortcode of untrusted input from the awl_gg_settings_ meta value. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Explanation of Vulnerability in Simple Terms
02Summary
The Grid Gallery for Images WordPress plugin through version 1.4.3 contains a deserialization vulnerability in how it processes user-supplied data. An authenticated attacker with low privileges can craft malicious serialized PHP objects that execute arbitrary code when deserialized. This allows complete compromise of the WordPress site, including data theft, modification, and service disruption.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site and take full control of WordPress.
Potential impact on your site
04Site Impact
Any logged-in user, even with minimal permissions, can compromise your entire WordPress installation and access all data.
Conditions required to exploit
05Prerequisites
Attacker must be logged in with at least low-level WordPress privileges (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
May 2, 2024
CVE published
April 8, 2026
Record updated
