PT-2025-45210 · WordPress+1 · 3D-Image-Gallery+1
CVE-2025-49394
·
Published
2025-08-26
·
Updated
2025-11-06
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
Image Gallery block – Create and display photo gallery/photo album versions prior to 1.0.8
Description
The plugin contains a missing authorization flaw where functionality is not properly constrained by Access Control Lists (ACLs). This occurs due to a missing capability check on several functions, allowing authenticated users with Subscriber-level access and above to view and activate plugins.
Recommendations
Update the plugin to a version newer than 1.0.7.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
3D-Image-Gallery
Image Gallery Block – Create/Display Photo Gallery/Photo Album.