CVE-2026-57696 HIGH

CVE-2026-57696: WordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerability

Vendor Videowhisper

Product Picture Gallery

Weakness CWE-22 · Path traversal

Published July 23, 2026

Last update July 23, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Picture Gallery versions up to 1.6.5 contain a path traversal vulnerability that allows authenticated users to manipulate file paths and corrupt or delete files on the server. An attacker with low-level access can bypass directory restrictions to write or delete arbitrary files, potentially disabling the site or modifying critical data. No confidentiality impact occurs, but integrity and availability are severely compromised.

What an attacker can do

03Attacker Capabilities

Write or delete files outside the intended gallery directory, disrupting site functionality or data.

Potential impact on your site

04Site Impact

Malicious users can corrupt or delete files, causing data loss or site downtime without admin intervention.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

July 23, 2026 CVE published

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-57696 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal

Related vulnerabilities