CVE-2025-12849 is a missing authorization vulnerability (CWE-862) in the Contest Gallery WordPress plugin, affecting all versions up to 28.0.2. The plugin registers the AJAX action 'cg_check_wp_admin_upload_v10' for both authenticated and unauthenticated users but fails to implement capability checks or nonce verification. This allows unauthenticated attackers to inject arbitrary media attachments into galleries and modify gallery metadata via this AJAX endpoint. However, the vulnerability does not allow file uploads or file movements on the server. The CVSS 3.1 base score is 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity only.

An attacker without authentication can inject arbitrary WordPress media attachments into galleries and manipulate gallery metadata, potentially affecting the integrity of gallery content. There is no impact on confidentiality or availability, and attackers cannot upload or move files on the server. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor the vendor's announcements for updates addressing this authorization bypass vulnerability. Until a fix is available, consider restricting access to the AJAX action or disabling the plugin if feasible to reduce exposure.