Unauthorized Setting Modification in Gallery Blocks Plugin for WordPress
CVE-2025-14288
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 13 December 2025
What is CVE-2025-14288?
The Gallery Blocks with Lightbox plugin for WordPress contains a security flaw that allows authenticated users with Contributor-level access or higher to alter plugin settings without proper authorization. This issue arises from a misconfiguration in the capability checks where edit_posts is used instead of manage_options for the update_option action in the AJAX handler. Consequently, this oversight enables attackers to exploit the plugin, potentially compromising its integrity by modifying settings prefixed with pgc_sgb_*.
Affected Version(s)
Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery * <= 3.3.0