Product Gallery Slider plugin missing authorization allows administrator takeover

A WordPress shop slider plugin where a manager can seize administrator rights.

Summary

A missing authorization check in the Product Gallery Slider WordPress plugin lets a Shop Manager read, overwrite or delete site options and gain administrator rights. Versions from 2.3.23 before 2.3.26 are affected.

Affected when

a Shop Manager account

What to do

Check that the plugin is newer than 2.3.26, and read the notice on the wordpress.org plugin page.

Products and platforms

Product Gallery Slider & Additional Variation Images for WooCommerce

CVE IDs

CVE-2026-120318 (opens in a new tab)

Sources

Advisory: wordpress.org (opens in a new tab)
Write-up: plugins.svn.wordpress.org (opens in a new tab) · plugins.svn.wordpress.org (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-02 14:28 UTC

First seen 2026-11-09 14:10 UTC