CVE-2025-15524 is a missing authorization vulnerability (CWE-862) in the Gallery by FooGallery WordPress plugin affecting all versions up to 3.1.9. The ajax_get_gallery_info() function lacks a capability check, enabling authenticated users with low privileges (Subscriber and above) to retrieve metadata of galleries that should be restricted, including private, draft, and password-protected galleries. This metadata exposure does not affect the gallery content itself but discloses identifying information such as gallery names, image counts, and thumbnail URLs. The vulnerability is network exploitable with low attack complexity and no user interaction required.

An attacker with authenticated Subscriber-level access or higher can enumerate gallery IDs to retrieve metadata of galleries that are intended to be private or restricted. This results in unauthorized disclosure of gallery metadata, which may aid in further reconnaissance or targeted attacks. The vulnerability does not allow modification or deletion of data, nor does it impact availability. The CVSS score of 4.3 reflects a limited confidentiality impact with no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity involving gallery metadata access. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from FooPlugins for an official patch or temporary mitigation.