Missing Authorization Flaw in Image Photo Gallery Plugin by WordPress
CVE-2026-25375

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Image Photo Gallery Final Tiles Grid
Vendor
CVE Published:
19 February 2026

What is CVE-2026-25375?

A missing authorization flaw in the WP Chill Image Photo Gallery Final Tiles Grid plugin enables attackers to exploit incorrectly configured access control security levels. This vulnerability affects versions up to 3.6.10, allowing unauthorized users to access sensitive features and potentially sensitive information. Proper access controls should be implemented to ensure that only authorized users can perform actions on the gallery.

Affected Version(s)

Image Photo Gallery Final Tiles Grid 0 <= 3.6.10

References

https://patchstack.com/database/Wordpress/Plugin/final-ti...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan | Patchstack Bug Bounty Program
.