WordPress security changelog
MEDIUM CVE-2025-12494 Deferred

Image Gallery – Photo Grid & Video Gallery: Arbitrary file deletion

Image Gallery – Photo Grid & Video Gallery is affected by arbitrary file deletion. Exploitation requires at least author-level access. A successful request can remove files outside the intended scope and may make the site unavailable.

CVE / CNA score 4.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Image Gallery – Photo Grid & Video Gallery
Plugin slug
modula-best-grid-gallery
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Nov 15, 2025
Weakness
CWE-285 — Improper Authorization

This CVE was published Nov 15, 2025 and is one of 10 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Image Gallery – Photo Grid & Video Gallery to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_import_file function in all versions up to, and including, 2.12.28. This makes it possible for authenticated attackers, with author-level access and above, to move arbitrary image files on the server.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Primary and upstream sources