CVE-2026-105977

The Portfolio Filter Gallery WordPress plugin versions before 2.2.1 is vulnerable to an authorization bypass due to a lack of per-object authorization checks. Specifically, the pfg_delete_video_thumbnail function fails to verify ownership, allowing users with the Contributor role and above to per...