CVE-2025-12494 MEDIUM

CVE-2025-12494: Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move

Vendor Wpchill
Product Modula Image Gallery – Photo Grid & Video Gallery
Weakness CWE-285
Published November 15, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_import_file function in all versions up to, and including, 2.12.28. This makes it possible for authenticated attackers, with author-level access and above, to move arbitrary image files on the server.

Explanation of Vulnerability in Simple Terms

02Summary

The Modula Image Gallery plugin for WordPress contains an improper access control vulnerability affecting versions up to 2.12.28. An authenticated user with low privileges can modify gallery settings and content they should not have access to. The vulnerability requires a valid WordPress account but no additional user interaction. Site administrators should update to a version newer than 2.12.28.

What an attacker can do

03Attacker Capabilities

Modify gallery settings or content without proper authorization.

Potential impact on your site

04Site Impact

Unauthorized users can alter gallery configurations, potentially defacing or disrupting image galleries on your site.

Conditions required to exploit

05Prerequisites

Valid WordPress user account with low privileges; network access to the site.

Key dates

06Disclosure timeline

November 15, 2025 CVE published
April 8, 2026 Record updated