Exploitation Research Plan - CVE-2026-39510

1. Vulnerability Summary

The Image Photo Gallery Final Tiles Grid plugin (<= 3.6.11) is vulnerable to an Insecure Direct Object Reference (IDOR). The vulnerability exists in the plugin's AJAX handlers—specifically those responsible for gallery management actions like deletion or cloning—because they lack a verification step to ensure the requesting user owns the object (gallery) specified by the ID.

While the plugin enforces an Author level capability check for access to the gallery management interface, it fails to perform object-level authorization. An authenticated user with Author privileges can perform unauthorized actions (like deleting or modifying) on galleries created by administrators or other users by manipulating the id parameter.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: ftg_delete_gallery (inferred as the most likely "unauthorized action" for this IDOR).
• HTTP Method: POST
• Parameter: id (the ID of the target gallery).
• Required Authentication: Authenticated user with Author role or higher.
• Preconditions: A gallery must exist that is owned by a different user (e.g., an Administrator).

3. Code Flow

1. Registration: The plugin registers AJAX actions in the main class (likely FinalTiles_Gallery) or an admin-specific class during init or admin_init.

   add_action('wp_ajax_ftg_delete_gallery', array($this, 'delete_gallery'));
   

2. Callback: The delete_gallery function is invoked.
3. Vulnerable Processing:
   • The function retrieves the gallery ID from $_POST['id'].
   • It verifies the request nonce (e.g., ftg_nonce).
   • It checks if the user has the general capability to manage galleries (e.g., current_user_can('publish_posts')).
   • Vulnerability: It proceeds to call the database deletion method (e.g., FinalTilesdb::deleteGallery($id)) without checking if the $current_user_id matches the author_id associated with that gallery record in the wp_ftg_galleries table.

4. Nonce Acquisition Strategy

The plugin enqueues a script and localizes gallery configuration variables, including a nonce, on the plugin's admin dashboard.

1. Identify Trigger: The scripts are loaded on the main gallery admin page: /wp-admin/admin.php?page=ftg-lite-gallery-admin.
2. Creation: No special shortcode is needed as the dashboard is accessible to any user with Author privileges (who can "publish posts").
3. Extraction:
   • Navigate to the dashboard.
   • Use browser_eval to extract the nonce from the ftg_vars (or ftg_lite_vars) object.
   • JS Key: window.ftg_vars?.nonce or window.ftg_lite_vars?.nonce.

5. Exploitation Strategy

Step 1: Discover Target Gallery ID

The attacker needs the ID of a gallery they do not own. Gallery IDs are often sequential or visible in the frontend source code of pages displaying galleries.

• Method: Check the homepage or any post for the shortcode: [finaltilesgallery id='X'].

Step 2: Obtain Nonce as Author

Log in as an Author and retrieve the nonce from the localized script.

Step 3: Trigger Unauthorized Deletion

Send a POST request to the AJAX endpoint targeting the Administrator's gallery ID.

Request Body (URL-encoded):

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=ftg_delete_gallery&id=[TARGET_ID]&_wpnonce=[EXTRACTED_NONCE]

6. Test Data Setup

1. Administrator: Create a gallery named "Admin Private Gallery" via the Final Tiles Gallery menu. Note its ID (e.g., 1).
2. Author: Create a user with the Author role.
3. Verification Record: Ensure the gallery exists in the database.

   wp db query "SELECT id, name FROM wp_ftg_galleries"
   

7. Expected Results

• The server should respond with a 200 OK and likely a success indicator (e.g., 1, true, or a JSON success message).
• The "Admin Private Gallery" record should be removed from the wp_ftg_galleries table.
• All associated image records in wp_ftg_images linked to that gallery ID should be deleted or orphaned.

8. Verification Steps

1. Database Check: Run a query via WP-CLI to verify the target gallery no longer exists.

   wp db query "SELECT count(*) FROM wp_ftg_galleries WHERE id = [TARGET_ID]"
   

   Expected Output: 0
2. Admin UI Check: Log in as Administrator and verify the gallery is missing from the list at /wp-admin/admin.php?page=ftg-lite-gallery-admin.

9. Alternative Approaches

If ftg_delete_gallery is not the vulnerable action, try the following IDOR-prone actions:

• ftg_save_gallery: Attempt to rename the Admin's gallery.
  • Body: action=ftg_save_gallery&id=[TARGET_ID]&name=DefacedByAuthor&_wpnonce=[NONCE]
• ftg_duplicate_gallery: Attempt to clone an Admin's gallery to see if the cloned version becomes owned by the Author, allowing information disclosure.
  • Body: action=ftg_duplicate_gallery&id=[TARGET_ID]&_wpnonce=[NONCE]
• ftg_shortcode_editor: Check if the picker allows viewing the configuration of non-owned galleries.
  • URL: /wp-admin/admin-ajax.php?action=ftg_shortcode_editor&id=[TARGET_ID] (GET)