Authorization Bypass in Image Photo Gallery Final Tiles Grid Plugin for WordPress

CVE-2025-14455

What is CVE-2025-14455?

The Image Photo Gallery Final Tiles Grid plugin for WordPress has an authorization bypass flaw present in all versions up to 3.6.7. This vulnerability arises from the plugin's failure to adequately verify user permissions before allowing access to gallery management functions. As a result, authenticated attackers with Contributor-level access or higher can exploit this weakness to delete, modify, or clone galleries created by any user, including those with administrative privileges. This lack of proper authorization checks poses serious risks to the integrity and security of user-generated content.

References