CVE-2025-14288

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14288", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-08T19:16:10.267Z", "datePublished": "2025-12-13T04:31:25.724Z", "dateUpdated": "2026-04-08T16:56:39.059Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:39.059Z"}, "affected": [{"vendor": "gallerycreator", "product": "Mixed Media Gallery Blocks", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to unauthorized modification of plugin settings in all versions up to, and including, 3.3.0. This is due to the plugin using the `edit_posts` capability check instead of `manage_options` for the `update_option` action type in the `pgc_sgb_action_wizard` AJAX handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify arbitrary plugin settings prefixed with `pgc_sgb_*`."}], "title": "Gallery Blocks with Lightbox <= 3.3.0 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60ab0311-888c-46ae-98fe-9e7d4dfe13bf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/tags/3.2.8/plugin.php#L593"}, {"url": "https://plugins.trac.wordpress.org/changeset/3418101/simply-gallery-block/trunk/plugin.php?old=3415010&old_path=simply-gallery-block%2Ftrunk%2Fplugin.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Karol Paciorek"}], "timeline": [{"time": "2025-12-12T15:46:53.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:43:31.588368Z", "id": "CVE-2025-14288", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:47:59.903Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14288", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:43:31.588368Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:43:32.655Z"}}], "cna": {"title": "Gallery Blocks with Lightbox <= 3.3.0 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification", "credits": [{"lang": "en", "type": "finder", "value": "Karol Paciorek"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "gallerycreator", "product": "Mixed Media Gallery Blocks", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.3.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-12T15:46:53.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60ab0311-888c-46ae-98fe-9e7d4dfe13bf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/tags/3.2.8/plugin.php#L593"}, {"url": "https://plugins.trac.wordpress.org/changeset/3418101/simply-gallery-block/trunk/plugin.php?old=3415010&old_path=simply-gallery-block%2Ftrunk%2Fplugin.php"}], "descriptions": [{"lang": "en", "value": "The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to unauthorized modification of plugin settings in all versions up to, and including, 3.3.0. This is due to the plugin using the `edit_posts` capability check instead of `manage_options` for the `update_option` action type in the `pgc_sgb_action_wizard` AJAX handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify arbitrary plugin settings prefixed with `pgc_sgb_*`."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:39.059Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14288", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:56:39.059Z", "dateReserved": "2025-12-08T19:16:10.267Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T04:31:25.724Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mixed Media Gallery Blocks", "vendor": "gallerycreator", "versions": [{"lessThanOrEqual": "3.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to unauthorized modification of plugin settings in all versions up to, and including, 3.3.0. This is due to the plugin using the `edit_posts` capability check instead of `manage_options` for the `update_option` action type in the `pgc_sgb_action_wizard` AJAX handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify arbitrary plugin settings prefixed with `pgc_sgb_*`."}, {"lang": "es", "value": "El plugin Gallery Blocks with Lightbox. Image Gallery, (v\u00eddeo HTML5, YouTube, Vimeo) Video Gallery y Lightbox para galer\u00edas nativas de WordPress es vulnerable a la modificaci\u00f3n no autorizada de la configuraci\u00f3n del plugin en todas las versiones hasta la 3.3.0, ambas inclusive. Esto se debe a que el plugin utiliza la comprobaci\u00f3n de capacidad 'edit_posts' en lugar de 'manage_options' para el tipo de acci\u00f3n 'update_option' en el gestor AJAX 'pgc_sgb_action_wizard'. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador o superior, modifiquen configuraciones arbitrarias del plugin prefijadas con 'pgc_sgb_*'."}], "id": "CVE-2025-14288", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14288", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:43:31.588368Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:48.310", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/tags/3.2.8/plugin.php#L593"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3418101/simply-gallery-block/trunk/plugin.php?old=3415010&old_path=simply-gallery-block%2Ftrunk%2Fplugin.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60ab0311-888c-46ae-98fe-9e7d4dfe13bf?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:14:13.942525+00:00", "value": {"mitigation_remediation": ["Upgrade the Gallery Blocks with Lightbox plugin to a version newer than 3.3.0 where the update option handler validates the manage_options capability.", "If an immediate upgrade is not possible, remove the edit_posts capability from any Contributor-level roles or replace those roles with stricter ones until the fix can be applied.", "Verify the integrity of the plugin\u2019s settings after upgrade or suspension of the affected roles, and monitor for unauthorized changes to any pgc_sgb_* options."], "summary": {"action": "Patch", "impact": "Unauthorized modification of plugin settings by authenticated users with Contributor access"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Mixed Media Gallery Blocks by gallerycreator, in all plugin releases up to and including version 3.3.0. Users running any of those versions are at risk unless they upgrade the plugin beyond 3.3.0.", "description_and_impact": "The Gallery Blocks with Lightbox plugin allows the AJAX handler used for updating options to check only for the edit_posts capability, rather than the higher manage_options capability required for changing plugin settings. Consequently, any authenticated user with Contributor level access or higher can call the update action and set arbitrary settings that begin with pgc_sgb_ through the plugin\u2019s UI. This flaw does not provide direct code execution, but it does allow the attacker to alter configuration values that may affect how media galleries are rendered or how lightbox functionality behaves.", "risk_and_exploitability": "The CVSS score is 4.3, indicating a moderate impact. The EPSS score of less than 1% suggests the likelihood of exploitation is very low at present. The flaw is not listed in the CISA KEV catalog, so there is no known active exploitation, but authenticated users of sufficient privilege can exploit the missing authorization check. PoC requires an AJAX request authenticated under Contributor or higher and the capability to modify pgc_sgb_* options in the database."}}}}, "created": "2025-12-14T21:15:08.322566+00:00", "updated": "2026-04-21T17:15:25.341592+00:00", "vendors": ["gallerycreator", "gallerycreator$PRODUCT$gallery_blocks_with_lightbox", "wordpress", "wordpress$PRODUCT$wordpress"]}