Arbitrary File Deletion in Image Gallery Plugin for WordPress

CVE-2025-12494

What is CVE-2025-12494?

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress contains a vulnerability that allows authenticated attackers with author-level access and above to delete arbitrary files on the server. This flaw arises from inadequate validation of file paths in the ajax_import_file function, which can lead to unauthorized file manipulation, presenting significant security risks to affected WordPress installations. Users are advised to update to the latest version and implement robust security measures to mitigate potential exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References