The vulnerability identified as CVE-2026-25345 affects the SimpLy Gallery plugin by GalleryCreator up to version 3.3.2. It stems from improper validation of a specified quantity in input, which results in access to functionality that should be restricted by ACLs but is not. This can allow an attacker with low privileges to escalate their access and perform unauthorized actions, severely impacting the system. The CVSS 3.1 base score of 9.9 reflects critical severity with network attack vector, low complexity, and high impact on confidentiality, integrity, and availability. The vulnerability is published and reserved as of early 2026, but no patch or mitigation details have been provided by the vendor.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive functionality within the SimpLy Gallery plugin, potentially allowing attackers to compromise the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.9, the impact is severe and could result in full system compromise or data breaches. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.