Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.2
CVE-2026-105977: Portfolio Filter Gallery lets contributors delete others' video thumbnails
CVE-2026-105977 · published 9 days ago
Summary
Versions 2.0.2 through 2.2.0 of the Portfolio Filter Gallery plugin let users who can contribute content remove video thumbnail images that belong to other users, even administrators. This could cause loss of important media files. Update the plugin to version 2.2.1 or later to stop the unauthorized deletions.
What to do
- Update unknown portfolio filter gallery to version 2.2.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | portfolio filter gallery | < 2.2.1 |
Original advisory text
Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.2
Low
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published10 Oct 2026
Updated16 Oct 2026
First seen10 Oct 2026
Track software like this
Free during beta