CVE-2025-15466

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15466", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-05T22:20:17.348Z", "datePublished": "2026-01-19T23:21:52.729Z", "dateUpdated": "2026-04-08T16:34:47.373Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:47.373Z"}, "affected": [{"vendor": "wpchill", "product": "Image Photo Gallery Final Tiles Grid", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to view, create, modify, clone, delete, and reassign ownership of galleries created by other users, including administrators."}], "title": "Image Photo Gallery Final Tiles Grid <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0afcfe15-2d7d-4c96-a408-28f35577a927?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3435746/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Mohammad Amin Hajian"}, {"lang": "en", "type": "finder", "value": "Pouria Shahba"}], "timeline": [{"time": "2025-12-21T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-05T22:35:42.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-19T10:31:17.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T15:11:40.962831Z", "id": "CVE-2025-15466", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:11:52.423Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15466", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T15:11:40.962831Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:11:46.400Z"}}], "cna": {"title": "Image Photo Gallery Final Tiles Grid <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management", "credits": [{"lang": "en", "type": "finder", "value": "Mohammad Amin Hajian"}, {"lang": "en", "type": "finder", "value": "Pouria Shahba"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpchill", "product": "Image Photo Gallery Final Tiles Grid", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.6.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-21T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-05T22:35:42.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-19T10:31:17.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0afcfe15-2d7d-4c96-a408-28f35577a927?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3435746/"}], "descriptions": [{"lang": "en", "value": "The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to view, create, modify, clone, delete, and reassign ownership of galleries created by other users, including administrators."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:47.373Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15466", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:34:47.373Z", "dateReserved": "2026-01-05T22:20:17.348Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-19T23:21:52.729Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Image Photo Gallery Final Tiles Grid", "vendor": "wpchill", "versions": [{"lessThanOrEqual": "3.6.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to view, create, modify, clone, delete, and reassign ownership of galleries created by other users, including administrators."}, {"lang": "es", "value": "El plugin Image Photo Gallery Final Tiles Grid para WordPress es vulnerable a acceso no autorizado y modificaci\u00f3n de datos debido a la falta de comprobaciones de capacidad en m\u00faltiples acciones AJAX en todas las versiones hasta la 3.6.9, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, puedan ver, crear, modificar, clonar, eliminar y reasignar la propiedad de galer\u00edas creadas por otros usuarios, incluidos los administradores."}], "id": "CVE-2025-15466", "lastModified": "2026-06-17T08:37:49.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15466", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T15:11:40.962831Z", "version": "2.0.3"}}]}, "published": "2026-01-20T00:15:47.820", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3435746/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0afcfe15-2d7d-4c96-a408-28f35577a927?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:08:54.018065+00:00", "value": {"mitigation_remediation": ["Upgrade the Image Photo Gallery Final Tiles Grid plugin to the latest available version (any release newer than 3.6.9), which contains the missing capability checks;", "Restrict Contributor role privileges, or configure the site to use stricter capability assignments, so that only trusted users can perform gallery management actions;", "Audit the site\u2019s user accounts to remove any unnecessary Contributor-level privileges, ensuring that only trusted users can manage galleries."], "summary": {"action": "Upgrade plugin", "impact": "Unauthorized access to gallery management"}, "threat_synthesis": {"affected_systems": "All WordPress installations that have the Image Photo Gallery Final Tiles Grid plugin installed in a version up to and including 3.6.9 are affected. This includes any host that relies on this plugin for gallery functionality. No specific server or operating system is required beyond a WordPress site using the vulnerable plugin version.", "description_and_impact": "The Image Photo Gallery Final Tiles Grid plugin for WordPress lacks capability checks on several AJAX endpoints, allowing an authenticated user with at least Contributor rights to view, create, modify, clone, delete, and reassign galleries owned by other users, including administrators. This defect permits a user to change or remove content they should not be able to, violating confidentiality, integrity, and potentially availability of photo galleries. The weakness is a missing authorization check, identified as CWE-862.", "risk_and_exploitability": "The CVSS score of 5.4 indicates a moderate severity. The EPSS score of less than 1\u202f% suggests a low probability that this vulnerability is actively exploited in the wild, and it is not listed in the CISA KEV catalog. Nevertheless, because the attack vector requires only authenticated access with Contributor-level permissions\u2014which are common on many sites\u2014an attacker can relatively easily manipulate gallery data once credentials are known or obtained. The vulnerability can be exploited simply by sending crafted AJAX requests from the client side, so network visibility or additional defenses outside WordPress are not required."}}}}, "created": "2026-01-20T08:40:22.280090+00:00", "updated": "2026-04-22T20:15:20.532164+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpchill", "wpchill$PRODUCT$image_photo_gallery_final_tiles_grid"]}