CVE-2026-102399

Executive Summary

CVE-2026-102399 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin "Photo Gallery by Supsystic" affecting versions 1.21.0 and earlier. Successful exploitation requires a victim (typically an authenticated administrative user) to visit a maliciously crafted page or click a weaponized link, allowing an attacker to force state-changing actions within the application context. The impact is limited to integrity and availability (CVSS 5.4), with no confidentiality loss, no privilege escalation inherent to the flaw, and no public exploit or Nuclei template currently available.

Technical Analysis

The vulnerability class is CWE-352 (Cross-Site Request Forgery). CSRF occurs when an application relies solely on ambient authentication credentials — such as session cookies — to authorize state-changing requests and fails to validate a per-request, unpredictable token (anti-CSRF nonce) or to enforce origin/referer checks. In the WordPress ecosystem, plugin administrative actions (typically registered via admin-ajax.php or admin-post.php handlers) are exposed to this class when they do not call the platform nonce verification functions (e.g., check_admin_referer or check_ajax_referer) or fail to validate a capability check in tandem. When these protections are absent, a third-party website can cause a logged-in administrator's browser to transmit a forged request automatically.

In the case of Photo Gallery by Supsystic <= 1.21.0, the CNA title and NVD description identify the flaw as an "Unauthenticated Cross Site Request Forgery (CSRF)". The term "unauthenticated" here indicates that the attacker does not need to authenticate to the target application to initiate the attack; they need only induce an already-authenticated victim to load attacker-controlled content. The exact vulnerable action(s), affected parameter(s), and absence/presence of nonce verification are not specified in the supplied NVD description, and no code-level details (specific function names, endpoint paths, or parameters) beyond the plugin name and version are provided. Therefore, this analysis does not attribute specific function names, endpoints, or parameters to the flaw beyond what the description states. Attack surface: any WordPress installation with the affected plugin active and an authenticated administrator session in a browser.

Because the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U, the flaw is network-reachable, has low attack complexity, requires no privileges on the attacker's part, and mandates user interaction. The scope is unchanged, indicating the vulnerable component and impacted component are the same; confidentiality impact is None (C:N), integrity impact is Low (I:L), and availability impact is Low (A:L), consistent with a state-changing action that modifies plugin data or causes limited service disruption rather than exfiltration or full compromise.

Exploitation Scenarios

The attack chain for this CSRF vulnerability, inferred strictly from the class and description, proceeds as follows:

1. Reconnaissance / Target Identification: The attacker identifies WordPress sites running Photo Gallery by Supsystic <= 1.21.0. This is achievable through public fingerprinting — plugin assets are typically referenced under the site's wp-content/plugins/photo-gallery path, and public version disclosure may be present in the page source. Mass scanning via Shodan or similar engines is feasible given the plugin's prior popularity.

2. Triggering the Flaw Class: The attacker constructs an HTML page (or injects content into a third-party site) that causes the victim's browser to issue a forged request against the vulnerable WordPress plugin action. Because the action performs a state-changing operation without requiring a valid anti-CSRF token, the victim's ambient session cookie is automatically attached by the browser to the cross-site request.

3. Payload / Execution Method: Delivery is typically via a hyperlink, an auto-submitting form, an <img> tag, or an iframe embedded in an attacker-controlled page. No specific parameter names or endpoints are disclosed in the available advisory data, so the precise request body cannot be described here without fabrication. The execution mechanism is the browser's automatic inclusion of session credentials on cross-origin requests to the target — a behavior inherent to cookies with SameSite=Lax/None or where the request is triggered by top-level navigation.

4. Post-Exploitation Impact: Given C:N/I:L/A:L, the attacker can cause low-integrity changes (e.g., modification of plugin configuration or content) and low availability impact. No data exfiltration is expected under the scored vector. Impact scales with the victim administrator's privileges — plugin administrators may enable broader WordPress functionality, but the vector does not indicate escalation of scope.

No public PoC is available; the attack chain is inferred from vulnerability class. No specific code pattern, function name, or parameter should be assumed beyond what the advisory states.

Impact Assessment

Business impact is moderate and bounded. Affected systems are WordPress installations with the plugin active and at least one administrative user likely to be socially engineered. Blast radius is limited to state changes permitted by the victim's privilege level — integrity impact is Low and availability impact is Low, with no confidentiality impact per the CVSS subscores (C:N). Systems with the plugin inactive are unaffected. Because UI:R is required, exploitation is not opportunistic autonomous compromise; it depends on targeted or mass-phished administrator interaction. EU-wide CVSS score 5.4 (Medium) places this below the threshold that typically triggers emergency patching, but it remains exploitable with no known mitigations supplied and no patch evidence from tracked sources. Internet-facing WordPress sites with administrative activity represent the primary risk group.

Detection Guidance

Sigma Rule

title: Potential CSRF Exploitation Attempt Against Photo Gallery by Supsystic (CVE-2026-102399)
id: 6d2a0d71-9b6e-4c9b-8c7a-1b3e9f5a2c10
status: experimental
description: Detects cross-site referer anomalies targeting WordPress admin endpoints associated with Photo Gallery by Supsystic plugin requests, consistent with CSRF abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102399
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1204
  - cve.2026-102399
logsource:
  category: webserver
  product: apache
  definition: Requires HTTP access logs with Referer and User-Agent fields.
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-admin/admin-post.php'
  selection_referer:
    cs(Referer)|contains:
      - 'wp-content/plugins/photo-gallery'
  filter_same_origin:
    cs(Referer)|contains: '/wp-admin/'
  condition: selection_uri and selection_referer and not filter_same_origin
falsepositives:
  - Legitimate cross-origin administrative tooling
level: low

YARA Rule

rule CVE_2026_102399_Photogallery_Supsystic_CSRF
{
    meta:
        description = "Detects WordPress Photo Gallery by Supsystic plugin versions up to 1.21.0 in web root (fingerprint)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102399"
        date = "2026-01-01"
        hash = "not_applicable"
    strings:
        $plugin_slug = "photo-gallery" ascii wide nocase
        $plugin_name = "Photo Gallery by Supsystic" ascii wide nocase
        $shortcode = "[gallery" ascii
    condition:
        uint16(0) == 0x504B or filesize < 5MB and
        any of ($plugin_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102399 Photo Gallery by Supsystic CSRF Attempt"; flow:to_server,established; http.uri; content:"/wp-admin/admin-ajax.php"; http.referer; pcre:"/https?:\/\/(?!.*\bwp-admin\b)/i"; http.referer; content:"photo-gallery"; nocase; sid:2026102399; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_102399; classtype:attempted-admin;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "GET" and http.request.uri : "/wp-admin/admin-ajax.php" ]
  [ network where http.request.method == "POST" and http.request.uri : "/wp-admin/admin-ajax.php" and http.request.referrer != null and not http.request.referrer : "*wp-admin*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(cs_uri_stem, "%/wp-admin/admin-ajax.php%") OR like(cs_uri_stem, "%/wp-admin/admin-post.php%")
| where like(referer, "%photo-gallery%") AND NOT like(referer, "%/wp-admin/%")
| stats count min(_time) as first_seen max(_time) as last_seen by clientip, cs_uri_stem, referer, useragent
| where count > 0
| table first_seen, last_seen, clientip, cs_uri_stem, referer, useragent, count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-102399,">
  <rule id="102399" level="10">
    <if_sid>31100</if_sid>
    <id>T1204</id>
    <match>/wp-admin/admin-ajax.php</match>
    <regex>photo-gallery</regex>
    <description>CVE-2026-102399 - Potential CSRF exploitation against Photo Gallery by Supsystic plugin</description>
    <mitre>
      <id>T1204</id>
    </mitre>
    <group>cve_2026_102399,csrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note: a newer plugin release than 1.21.0 (the upper bound in the affected range) may exist independently of tracked patch evidence; vendors should verify directly with the plugin author before upgrading on production sites.

1. Immediate Mitigations

   • Treat all incoming administrative requests as untrusted until origin and referer are validated at the reverse proxy/WAF layer; enforce same-origin enforcement for /wp-admin/ administrative endpoints.
   • Deploy virtual patching via WAF rules that block POST requests to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php with a missing or cross-origin Referer/Origin header for plugin-associated actions.
   • Enable browser-side protections: set the WordPress admin session cookie with SameSite=Strict where compatible, and ensure Secure and HttpOnly flags are present.
   • Reduce the window of exposure by logging out of WordPress administrative sessions when not actively in use and not browsing untrusted sites while authenticated.

2. Patch / Upgrade Steps

   • Confirm with the plugin vendor whether a version later than 1.21.0 resolves the flaw; no vendor advisory or patch reference is currently tracked for CVE-2026-102399.
   • As a fallback, deactivate and uninstall the Photo Gallery by Supsystic plugin if gallery functionality is non-essential.
   • Track the NVD entry and WordPress.org plugin changelog for updates.

3. Long-Term Hardening

   • Enforce anti-CSRF controls (per-request nonces and capability checks) as a development standard; where third-party plugin code cannot be modified, wrap administrative actions with token validation at the WAF.
   • Adopt a Content Security Policy that restricts form submissions and iframe embedding to same-origin.
   • Maintain an inventory of WordPress plugins and versions; subscribe to plugin-specific vulnerability feeds.
   • Implement principle-of-least-privilege for administrative accounts and avoid daily-driving the browser while logged in as an administrator on production sites.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-102399
• https://cwe.mitre.org/data/definitions/352.html
• https://owasp.org/www-community/attacks/csrf
• https://attack.mitre.org/techniques/T1204/
• https://www.wordfence.com/threat-intel/ (plugin-specific advisories; check for Photo Gallery by Supsystic entries)

No threat actor campaign, exploit-in-the-wild evidence, or CISA KEV listing is associated with CVE-2026-102399 at the time of writing. No public PoC, Nuclei template, or exploit code is available per the supplied intelligence.