{"id":"CVE-2026-119484","kind":"vulnerability","aliases":["CVE-2026-119484"],"related":[],"title":"WordPress Photo Gallery plugin: CSRF lets attackers trigger actions as admins","description":"Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows Cross Site Request Forgery.This issue affects Photo Gallery by Supsystic: from n/a through 1.21.6.","summary":"Photo Gallery by Supsystic, a WordPress plugin, has a cross-site request forgery flaw affecting versions through 1.21.6. An attacker can trick a logged-in user's browser into sending requests the plugin accepts without checking intent.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","photo-gallery-by-supsystic","wordpress"],"not_affected_if":["plugin-not-installed","version-above-1.21.6"],"how_to_check":"- Check the installed version of Photo Gallery by Supsystic (gallery-by-supsystic) in the WordPress plugins list or the plugin's readme.txt\n- Compare it against `1.21.6`; versions at or below that are in the range the sources give","fix":"- Photo Gallery by Supsystic: a fixed version is not stated in the sources; check the plugin page for a release newer than `1.21.6`","status":"open","published_at":"2026-11-07T10:17:07+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","triaged_at":"2026-11-07T10:48:37+00:00","updated_at":"2026-11-07T10:48:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T10:48:37Z","model":"claude-haiku-5-5","output":{"fix":"- Photo Gallery by Supsystic: a fixed version is not stated in the sources; check the plugin page for a release newer than `1.21.6`","reach":"internet","title":"WordPress Photo Gallery plugin: CSRF lets attackers trigger actions as admins","impact":"medium","summary":"Photo Gallery by Supsystic, a WordPress plugin, has a cross-site request forgery flaw affecting versions through 1.21.6. An attacker can trick a logged-in user's browser into sending requests the plugin accepts without checking intent.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","photo-gallery-by-supsystic"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker performs gallery changes as a logged-in admin","analyst_note":"Confirm the fixed version and the affected actions from the NVD entry or the plugin's changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-119484.","how_to_check":"- Check the installed version of Photo Gallery by Supsystic (gallery-by-supsystic) in the WordPress plugins list or the plugin's readme.txt\n- Compare it against `1.21.6`; versions at or below that are in the range the sources give\n- unknown for any other check, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-1.21.6"],"who_is_affected":"Sites running the Photo Gallery by Supsystic WordPress plugin at version 1.21.6 or earlier are in the range given. The exploit needs a logged-in privileged user to visit a malicious page, so sites with no logged-in administrators active are less exposed. The sources do not say which specific actions are affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000759,"input_tokens":4240,"output_tokens":670,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119484':14A,17A '-2026':13A,16A '1.21.6':43B,95C 'accept':60B 'action':9A 'admin':11A 'affect':40B,87C 'allow':81C 'attack':7A,45B 'browser':54B 'check':62B 'cross':35B,65C,82C 'cross-sit':34B,64C 'csrf':5A,69C 'cve':12A,15A 'flaw':39B 'forgeri':38B,68C 'forgery.this':85C 'galleri':3A,21B,26B,74C,78C,89C 'gallery-by-supsyst':77C 'intent':63B 'issu':86C 'let':6A 'log':50B 'logged-in':49B 'n/a':93C 'packag':18B 'photo':2A,20B,25B,73C,88C 'photo-gallery-by-supsyst':19B 'plugin':4A,31B,59B 'request':37B,57B,67C,84C 'send':56B 'site':36B,66C,83C 'supsyst':23B,28B,72C,76C,80C,91C 'trick':47B 'trigger':8A 'user':52B 'version':41B 'vulner':70C 'without':61B 'wordpress':1A,24B,30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Photo Gallery by Supsystic WordPress plugin at version 1.21.6 or earlier are in the range given. The exploit needs a logged-in privileged user to visit a malicious page, so sites with no logged-in administrators active are less exposed. The sources do not say which specific actions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","photogallerybysupsystic","wordpress"],"campaign_type":null,"search_a":"'-119484':14A,17A '-2026':13A,16A 'action':9A 'admin':11A 'attack':7A 'csrf':5A 'cve':12A,15A 'galleri':3A 'let':6A 'photo':2A 'plugin':4A 'trigger':8A 'wordpress':1A","search_b":"'1.21.6':43B 'accept':60B 'affect':40B 'attack':45B 'browser':54B 'check':62B 'cross':35B 'cross-sit':34B 'flaw':39B 'forgeri':38B 'galleri':21B,26B 'intent':63B 'log':50B 'logged-in':49B 'packag':18B 'photo':20B,25B 'photo-gallery-by-supsyst':19B 'plugin':31B,59B 'request':37B,57B 'send':56B 'site':36B 'supsyst':23B,28B 'trick':47B 'user':52B 'version':41B 'without':61B 'wordpress':24B,30B","search_c":"'1.21.6':95C 'affect':87C 'allow':81C 'cross':65C,82C 'cross-sit':64C 'csrf':69C 'forgeri':68C 'forgery.this':85C 'galleri':74C,78C,89C 'gallery-by-supsyst':77C 'issu':86C 'n/a':93C 'photo':73C,88C 'request':67C,84C 'site':66C,83C 'supsyst':72C,76C,80C,91C 'vulner':70C","first_public_at":"2026-11-07T10:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119484","severity":null,"published_at":"2026-11-07T10:17:07+00:00","modified_at":"2026-11-07T10:17:07+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","fetched_at":"2026-11-07T10:46:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}