CVE-2025-12494 – The Image Gallery plugin for WordPress has a vu... (How to Fix)

Q: What is the severity of CVE-2025-12494?

CVE-2025-12494 has a CVSS score of 4.3 (MEDIUM). The Image Gallery plugin for WordPress has a vulnerability that allows authenticated attackers with author-level permissions or higher to delete arbitrary image files on the server. This occurs due to insufficient file path validation in the ajax_import_file function. All WordPress sites using vulnerable versions of this plugin are affected.

📋 TL;DR

The Image Gallery plugin for WordPress has a vulnerability that allows authenticated attackers with author-level permissions or higher to delete arbitrary image files on the server. This occurs due to insufficient file path validation in the ajax_import_file function. All WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:

Image Gallery – Photo Grid & Video Gallery WordPress plugin

Versions: All versions up to and including 2.12.28

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires attacker to have author-level WordPress user account or higher. Plugin must be installed and active.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could delete critical system files, causing service disruption, data loss, or complete website compromise if sensitive files are removed.

🟠

Likely Case

Attackers delete website images and media files, causing content loss and website functionality issues that require restoration from backups.

🟢

If Mitigated

With proper access controls and file permissions, impact is limited to non-critical files within the web directory, causing minimal disruption.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is technically simple once credentials are obtained. The vulnerability is publicly documented with code references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.12.29 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3391790/modula-best-grid-gallery/trunk?contextall=1&old=3390878&old_path=%2Fmodula-best-grid-gallery%2Ftrunk

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Image Gallery – Photo Grid & Video Gallery'. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.12.29+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the Image Gallery plugin until patched

wp plugin deactivate modula-best-grid-gallery

Restrict author-level access

all

Review and reduce number of users with author permissions or higher

🧯 If You Can't Patch

Implement strict file permissions on web directory (755 for directories, 644 for files)
Enable WordPress activity logging to monitor for suspicious file operations

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Installed Plugins for 'Image Gallery – Photo Grid & Video Gallery' version 2.12.28 or lower

Check Version:

wp plugin get modula-best-grid-gallery --field=version

Verify Fix Applied:

Verify plugin version is 2.12.29 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual file deletion events in WordPress logs
Multiple failed file operations from single user
Author-level users performing unexpected file management

Network Indicators:

POST requests to /wp-admin/admin-ajax.php with action=modula_import_file containing unusual file paths

SIEM Query:

source="wordpress.log" AND "modula_import_file" AND ("unlink" OR "move_uploaded_file" OR "file operation failed")

📊 Metadata

CVE ID: CVE-2025-12494

CVSS v3 Score: 4.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE: CWE-285

EPSS Score: 0.04% exploit probability (11.5th percentile)

Published: November 15, 2025

Last Updated: November 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-12494, you might also want to check these: