Arbitrary File Deletion in Image Gallery Plugin for WordPress

CVE-2025-12494

What is CVE-2025-12494?

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress contains a vulnerability that allows authenticated attackers with author-level access and above to delete arbitrary files on the server. This flaw arises from inadequate validation of file paths in the ajax_import_file function, which can lead to unauthorized file manipulation, presenting significant security risks to affected WordPress installations. Users are advised to update to the latest version and implement robust security measures to mitigate potential exploits.

References