CVE-2025-15466: CWE-862 Missing Authorization in wpchill Image Photo Gallery Final Tiles Grid
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to view, create, modify, clone, delete, and reassign ownership of galleries created by other users, including administrators.
AI Analysis
Technical Summary
CVE-2025-15466 describes a missing authorization (CWE-862) vulnerability in the wpchill Image Photo Gallery Final Tiles Grid WordPress plugin. The flaw exists in all versions up to and including 3.6.9, where multiple AJAX actions lack proper capability checks. This enables authenticated users with Contributor-level privileges or higher to perform unauthorized operations on galleries created by other users, including administrators. The vulnerability impacts confidentiality and integrity but not availability, reflected in the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N and a score of 5.4.
Potential Impact
Authenticated users with Contributor-level access or above can bypass authorization controls to view, create, modify, clone, delete, and reassign ownership of galleries belonging to other users, including administrators. This compromises data confidentiality and integrity within the affected plugin's galleries. There is no indication of availability impact or known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access where possible and monitor for suspicious activity related to the Image Photo Gallery Final Tiles Grid plugin. Avoid granting Contributor or higher privileges to untrusted users. Follow vendor channels for updates on patches or official fixes.
CVE-2025-15466: CWE-862 Missing Authorization in wpchill Image Photo Gallery Final Tiles Grid
Description
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to view, create, modify, clone, delete, and reassign ownership of galleries created by other users, including administrators.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-15466 describes a missing authorization (CWE-862) vulnerability in the wpchill Image Photo Gallery Final Tiles Grid WordPress plugin. The flaw exists in all versions up to and including 3.6.9, where multiple AJAX actions lack proper capability checks. This enables authenticated users with Contributor-level privileges or higher to perform unauthorized operations on galleries created by other users, including administrators. The vulnerability impacts confidentiality and integrity but not availability, reflected in the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N and a score of 5.4.
Potential Impact
Authenticated users with Contributor-level access or above can bypass authorization controls to view, create, modify, clone, delete, and reassign ownership of galleries belonging to other users, including administrators. This compromises data confidentiality and integrity within the affected plugin's galleries. There is no indication of availability impact or known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access where possible and monitor for suspicious activity related to the Image Photo Gallery Final Tiles Grid plugin. Avoid granting Contributor or higher privileges to untrusted users. Follow vendor channels for updates on patches or official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-01-05T22:20:17.348Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 696ebfdb4623b1157cd409c0
Added to database: 1/19/2026, 11:35:55 PM
Last enriched: 4/9/2026, 9:21:39 PM
Last updated: 5/8/2026, 2:03:08 PM
Views: 185
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.