What the vulnerability does
01Description
The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to unauthorized modification of plugin settings in all versions up to, and including, 3.3.0. This is due to the plugin using the `edit_posts` capability check instead of `manage_options` for the `update_option` action type in the `pgc_sgb_action_wizard` AJAX handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify arbitrary plugin settings prefixed with `pgc_sgb_*`.
Explanation of Vulnerability in Simple Terms
02Summary
Mixed Media Gallery Blocks versions 3.3.0 and earlier lack proper authorization checks, allowing authenticated users to modify gallery content they should not have access to. An attacker with low-level site access can alter or corrupt galleries belonging to other users or restricted areas. The vulnerability requires an existing user account but no additional user interaction.
What an attacker can do
03Attacker Capabilities
Modify or corrupt gallery content belonging to other users or restricted areas.
Potential impact on your site
04Site Impact
Galleries may be altered or deleted by unauthorized users with basic site access, compromising content integrity.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site; no special interaction required.
Key dates
06Disclosure timeline
December 13, 2025
CVE published
April 8, 2026
Record updated
