Unauthorized Data Modification in Envira Photo Gallery Plugin for WordPress

CVE-2025-12377

What is CVE-2025-12377?

The Envira Photo Gallery plugin for WordPress contains a vulnerability that allows authenticated attackers with Author-level access and above to modify gallery data without proper restrictions. Specifically, a missing capability check on several functions enables these users to perform actions like deleting images from any gallery. This issue impacts all plugin versions up to and including 1.12.0. A partial patch was applied in version 1.12.0, but users are advised to secure their installations and stay updated to mitigate potential risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References