CVE-2025-12377

MEDIUM

Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-12377 has a selected CVSS score of 4.3 (medium).

Description

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Author-level access and above, to perform multiple actions, such as removing images from arbitrary galleries. The vulnerability was partially patched in version 1.12.0.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 19, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More

Browse smub / Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More

Default status: unaffected

CVE ListThrough 1.12.0affected

References

7