CVE-2025-14170 describes a missing authorization vulnerability (CWE-862) in the Vimeo SimpleGallery plugin for WordPress, versions up to and including 0.2. The issue arises because the vimeogallery_admin function, which is hooked to the admin_menu action, lacks proper authorization checks. As a result, authenticated users with Subscriber-level privileges or higher can manipulate plugin settings arbitrarily by controlling the action parameter. This vulnerability does not affect confidentiality or availability but impacts integrity by allowing unauthorized modification of plugin settings.

An attacker with Subscriber-level access or above can modify arbitrary settings of the Vimeo SimpleGallery plugin without proper authorization. This could lead to unauthorized changes in plugin behavior or configuration, potentially affecting site functionality or security posture. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for unusual plugin configuration changes. Avoid granting unnecessary privileges to low-level authenticated users.