What the vulnerability does
01Description
The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admin_init hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php. The vulnerable code checks only for the presence of the 'permalink_structure' POST parameter before updating the 'wbg_cpt_slug' option, without verifying that the request comes from an authenticated administrator. This makes it possible for unauthenticated attackers to modify the custom post type slug for the books gallery, which changes the URL structure for all book entries and can break existing links and SEO rankings.
Explanation of Vulnerability in Simple Terms
02Summary
WP Books Gallery versions up to 4.8.0 lack proper authorization checks, allowing unauthenticated attackers to modify site content. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a version newer than 4.8.0 to prevent unauthorized changes to book gallery data.
What an attacker can do
03Attacker Capabilities
Modify book gallery content without logging in or having permission.
Potential impact on your site
04Site Impact
Attackers can alter or deface book gallery displays without your knowledge or consent.
Conditions required to exploit
05Prerequisites
Network access to the WordPress site; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 24, 2026
CVE published
April 24, 2026
Record updated
