CVE-2026-32330: 
WordPress vulnerability analysis and mitigation

CVE-2026-32330 is a Cross-Site Request Forgery (CSRF) vulnerability in the Photo Gallery by 10Web WordPress plugin, affecting versions up to and including 1.8.37. It was reported by researcher Cid_Kagenou_Sama on January 9, 2026, and published by Patchstack on February 8, 2026. The vulnerability allows unauthenticated attackers to forge requests on behalf of authenticated users, potentially causing unintended actions within the plugin. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from insufficient or missing CSRF token validation in the Photo Gallery by 10Web plugin. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user (such as an administrator), triggers unauthorized state-changing requests to the plugin's endpoints without the victim's knowledge. Exploitation requires user interaction — specifically, a privileged user must be tricked into clicking a malicious link or visiting a crafted page (Patchstack).

Successful exploitation could allow a malicious actor to force higher-privileged WordPress users (e.g., administrators) to execute unwanted actions within the Photo Gallery plugin under their current authentication context, such as modifying gallery settings, deleting content, or altering plugin configurations. The primary impact is on integrity (rated Low), with no direct confidentiality or availability impact. While the individual impact is limited, CSRF vulnerabilities in WordPress plugins are frequently leveraged in mass-exploit campaigns targeting thousands of sites simultaneously (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.008% (0.000080), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited, though CSRF vulnerabilities in WordPress plugins are sometimes included in mass-exploit campaigns (Patchstack).

1. Reconnaissance: Identify WordPress sites running Photo Gallery by 10Web plugin version ≤ 1.8.37 using tools like WPScan or Shodan.
2. Craft malicious payload: Create an HTML page containing a hidden form or JavaScript that automatically submits a forged HTTP request to a vulnerable plugin endpoint (e.g., a gallery management action) without a valid CSRF nonce.
3. Social engineering: Deliver the malicious link or page to an authenticated WordPress administrator via phishing email, comment, or other social engineering vector.
4. Trigger exploitation: When the authenticated admin visits the crafted page, their browser automatically submits the forged request, causing the plugin to execute the attacker-specified action (e.g., modifying gallery settings or deleting galleries) under the admin's session (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to Photo Gallery plugin admin endpoints (e.g., /wp-admin/admin.php?page=photo-gallery*) originating from unusual referrers or external domains.
• Application: Unexplained changes to gallery configurations, deleted galleries, or modified plugin settings without corresponding administrator activity.
• Network: HTTP requests to WordPress admin plugin endpoints with Referer headers pointing to external or unknown domains.

The vendor has released a patched version: Photo Gallery by 10Web 1.8.38, which resolves the CSRF vulnerability. Site administrators should update the plugin to version 1.8.38 or later immediately. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting access to the WordPress admin panel to trusted IP addresses. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).