Medium · 5.4 CVE-2022-38135 EUVD-2022-40737GHSA-cvjg-9hcx-pvx4

WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability

Published Sep 12, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Dean Oakley Product: Photospace Gallery (WordPress plugin) Category: Web / CMS

Description

Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings.

Affected products

Vendor	Product	Affected	Fixed
Dean Oakley	Photospace Gallery (WordPress plugin)	<= 2.3.5 – ≤ 2.3.5	—

References

https://patchstack.com/database/vulnerability/photospace/wordpress-photospace-gallery-plugin-2-3-5-broken-access-control-vulnerability
https://wordpress.org/plugins/photospace/