PT-2026-20577

CVE-2025-12081

·

Published

2026-02-18

·

Updated

2026-02-23

Description by

CVSS 3.1
4.3
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions ACF Photo Gallery Field versions prior to 3.1
Description The ACF Photo Gallery Field plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check within the acf photo gallery edit save function. Authenticated attackers with subscriber-level access or higher can modify the title, caption, and custom metadata of media attachments.
Recommendations Update ACF Photo Gallery Field to version 3.1 or later.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-862: Missing Authorization
Related identifiers
CVE-2025-12081
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com