WordPress Plugin Vulnerabilities

Image Gallery – Photo Grid & Video Gallery < 2.12.29 - Author+ Arbitrary Image File Move

Description

The plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_import_file function. This makes it possible for authenticated attackers, with author-level access and above, to move arbitrary image files on the server.

Affects Plugins

Plugin icon
modula-best-grid-gallery
Fixed in 2.12.29

References

CVE
CVE-2025-12494
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ca423309-d8bd-46a4-9e88-9534d9c60b4a

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Verified
No
WPVDB ID
277f2785-50a8-4693-9403-bc827dc50ee7

Timeline

Publicly Published
2025-11-14 (about 7 months ago)
Added
2025-11-14 (about 7 months ago)
Last Updated
2025-11-14 (about 7 months ago)

Other

Published
Title
Published
2023-05-12
Title
WPCS – WordPress Currency Switcher Professional < 1.2.0 - Subscriber+ Missing Authorization Checks
Published
2022-02-02
Title
Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access
Published
2025-11-26
Title
Folders < 3.1.6 - Incorrect Authorization to Authenticated (Contributor+) Folder Content Manipulation
Published
2026-01-05
Title
Timetics < 1.0.48 - Incorrect Authorization to Authenticated (Timetics Customer+) User Creation
Published
2025-08-28
Title
LWSCache < 2.9 - Subscriber+ Limited Plugin Activation