CVE-2025-14288
📋 TL;DR
This vulnerability allows authenticated WordPress users with Contributor-level access or higher to modify plugin settings for the Gallery Blocks with Lightbox plugin. Attackers can change arbitrary plugin settings prefixed with 'pgc_sgb_*', potentially disrupting gallery functionality or enabling further attacks. All WordPress sites using this plugin up to version 3.3.0 are affected.
💻 Affected Systems
- Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery WordPress plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
An attacker could disable security features, modify gallery behavior to serve malicious content, or create persistent backdoors through plugin configuration changes.
Likely Case
Attackers modify gallery settings to disrupt website functionality, inject unwanted content, or degrade user experience.
If Mitigated
With proper user role management and monitoring, impact is limited to minor configuration changes that can be quickly reverted.
🎯 Exploit Status
Exploitation requires authenticated access with at least Contributor privileges. The vulnerability is in a publicly accessible AJAX handler with insufficient capability checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.1 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3418101/simply-gallery-block/trunk/plugin.php?old=3415010&old_path=simply-gallery-block%2Ftrunk%2Fplugin.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Gallery Blocks with Lightbox' plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 3.3.1+ from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Restrict User Roles
allTemporarily remove Contributor and Author roles from untrusted users until patch is applied.
Disable Plugin
allDeactivate the vulnerable plugin if gallery functionality is not critical.
🧯 If You Can't Patch
- Implement strict user role management and limit Contributor accounts to trusted personnel only.
- Monitor WordPress admin logs for unauthorized plugin setting changes and implement web application firewall rules to block suspicious AJAX requests.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins. If 'Gallery Blocks with Lightbox' version is 3.3.0 or lower, the site is vulnerable.Check Version:
wp plugin list --name='Gallery Blocks with Lightbox' --field=version (requires WP-CLI)Verify Fix Applied:
After updating, verify plugin version shows 3.3.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual AJAX requests to admin-ajax.php with action 'pgc_sgb_action_wizard' from non-admin users
- Plugin setting changes in WordPress logs from users with insufficient privileges
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with 'action=pgc_sgb_action_wizard' parameter from non-admin IP addresses
SIEM Query:
source="wordpress.log" AND "pgc_sgb_action_wizard" AND (user_role="contributor" OR user_role="author")🔗 References
- https://plugins.trac.wordpress.org/browser/simply-gallery-block/tags/3.2.8/plugin.php#L593
- https://plugins.trac.wordpress.org/changeset/3418101/simply-gallery-block/trunk/plugin.php?old=3415010&old_path=simply-gallery-block%2Ftrunk%2Fplugin.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/60ab0311-888c-46ae-98fe-9e7d4dfe13bf?source=cve
