CVE-2026-1036: 
WordPress vulnerability analysis and mitigation

CVE-2026-1036 is a Missing Authorization vulnerability in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress. It allows unauthenticated attackers to delete arbitrary image comments due to a missing capability check on the delete_comment() function. All plugin versions up to and including 1.8.36 are affected; the comments functionality is only present in the Pro version. It carries a CVSS v3.1 base score of 5.3 (Medium) and was published on January 22, 2026 (Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization). The delete_comment() function in the plugin fails to verify whether the requesting user has the appropriate WordPress capability before processing the deletion request. Because no authentication or privilege check is enforced, any unauthenticated network-accessible attacker can send a crafted HTTP request to invoke this function and delete image comments. Exploitation requires no user interaction, no special privileges, and low attack complexity (Red Hat CVE).

Successful exploitation results in unauthorized deletion of arbitrary image comments on affected WordPress sites running the Pro version of the plugin. The impact is limited to data integrity — confidentiality and availability are not affected. While the scope is constrained to comment data, mass deletion of user-generated content could degrade site functionality and user trust. There is no known path to lateral movement or code execution via this vulnerability alone (Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2026-1036. The EPSS score is approximately 0.054%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Pro version of the Photo Gallery by 10Web plugin (version ≤ 1.8.36) using passive techniques such as checking plugin metadata exposed in page source or using tools like WPScan.
2. Identify target comments: Browse the gallery pages of the target site to enumerate image comment IDs (typically exposed in HTML source or via REST API responses).
3. Craft malicious request: Construct an unauthenticated HTTP POST or GET request targeting the WordPress AJAX endpoint (e.g., wp-admin/admin-ajax.php) with the action parameter mapped to the delete_comment() function and the target comment ID as a parameter.
4. Execute deletion: Submit the request without any authentication headers or nonce validation. Due to the missing capability check, the server processes the request and deletes the specified comment.
5. Repeat: Iterate over additional comment IDs to delete multiple or all image comments on the site (Red Hat CVE).

• Network: Repeated unauthenticated POST requests to wp-admin/admin-ajax.php with action parameters associated with the 10Web Photo Gallery comment deletion function, originating from a single or rotating IP address.
• Logs: WordPress access logs showing high-frequency requests to the AJAX endpoint without session cookies or authentication tokens; HTTP 200 responses to comment deletion actions from unauthenticated sources.
• Application: Sudden unexplained disappearance of image comments in the Photo Gallery Pro plugin; gaps in comment IDs in the database (bwg_comments table or equivalent).

Update the Photo Gallery by 10Web plugin to a version above 1.8.36, which includes the fix for the missing capability check. If an immediate update is not possible, consider temporarily disabling the comments feature within the plugin settings or restricting access to wp-admin/admin-ajax.php via web application firewall (WAF) rules for unauthenticated users. Sucuri's January 2026 vulnerability patch roundup also highlights this issue as part of broader WordPress plugin patching guidance (Sucuri Blog).

Sucuri included CVE-2026-1036 in their January 2026 vulnerability patch roundup, recommending prompt updates for affected WordPress site owners (Sucuri Blog). The vulnerability received standard coverage from automated CVE tracking services and Spanish national cybersecurity agencies (INCIBE-CERT, CCN-CERT), but no notable independent researcher commentary or significant social media discussion has been identified.