CVE-2025-12494: CWE-285 Improper Authorization in wpchill Modula Image Gallery – Photo Grid & Video Gallery
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_import_file function in all versions up to, and including, 2.12.28. This makes it possible for authenticated attackers, with author-level access and above, to move arbitrary image files on the server.
AI Analysis
Technical Summary
The Modula Image Gallery – Photo Grid & Video Gallery WordPress plugin suffers from an improper authorization vulnerability (CWE-285) in the ajax_import_file function. Authenticated users with author-level privileges or above can exploit insufficient file path validation to delete arbitrary image files on the server. This affects all versions up to 2.12.28. The CVSS 3.1 base score is 4.3 (medium), reflecting the network attack vector, low complexity, and limited impact to integrity without confidentiality or availability loss. No official patch or vendor advisory is currently available.
Potential Impact
An attacker with author-level access or higher can delete arbitrary image files on the server, potentially disrupting the website's content integrity. There is no impact to confidentiality or availability reported. The vulnerability does not allow unauthenticated access or privilege escalation beyond author-level users.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level access to trusted users only and monitor for suspicious activity related to file deletions within the plugin. Avoid granting author or higher privileges to untrusted users.
CVE-2025-12494: CWE-285 Improper Authorization in wpchill Modula Image Gallery – Photo Grid & Video Gallery
Description
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_import_file function in all versions up to, and including, 2.12.28. This makes it possible for authenticated attackers, with author-level access and above, to move arbitrary image files on the server.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Modula Image Gallery – Photo Grid & Video Gallery WordPress plugin suffers from an improper authorization vulnerability (CWE-285) in the ajax_import_file function. Authenticated users with author-level privileges or above can exploit insufficient file path validation to delete arbitrary image files on the server. This affects all versions up to 2.12.28. The CVSS 3.1 base score is 4.3 (medium), reflecting the network attack vector, low complexity, and limited impact to integrity without confidentiality or availability loss. No official patch or vendor advisory is currently available.
Potential Impact
An attacker with author-level access or higher can delete arbitrary image files on the server, potentially disrupting the website's content integrity. There is no impact to confidentiality or availability reported. The vulnerability does not allow unauthenticated access or privilege escalation beyond author-level users.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level access to trusted users only and monitor for suspicious activity related to file deletions within the plugin. Avoid granting author or higher privileges to untrusted users.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-10-29T20:58:17.650Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6918143b93cc35e7aa3af0e2
Added to database: 11/15/2025, 5:48:43 AM
Last enriched: 4/9/2026, 9:20:42 AM
Last updated: 5/10/2026, 1:34:48 PM
Views: 117
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.