CVE-2025-13685

Name of the Vulnerable Software and Affected Versions The Photo Gallery by Ays plugin for WordPress versions prior to 6.4.9

Description The software is susceptible to Cross-Site Request Forgery due to a lack of nonce verification on the bulk action functionality within the process bulk action() function. This allows unauthenticated attackers to perform bulk operations – including deleting, publishing, or unpublishing galleries – if they can trick an administrator into performing an action, such as clicking a link.

Recommendations Update The Photo Gallery by Ays plugin to version 6.4.9 or later.