PT-2025-51064 · WordPress · Gallery Blocks With Lightbox

Karol Paciorek · Publicado 2025-12-13 · Atualizado 2025-12-13 · CVE-2025-14288

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Gallery Blocks with Lightbox versions prior to 3.3.1

Description The Gallery Blocks with Lightbox WordPress plugin is susceptible to unauthorized modification of plugin settings. This occurs because the plugin incorrectly uses the edit posts capability check instead of manage options for the update option action type within the pgc sgb action wizard AJAX handler. Authenticated attackers possessing Contributor-level access or higher can modify arbitrary plugin settings prefixed with pgc sgb *.

Recommendations Update The Gallery Blocks with Lightbox to version 3.3.1 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14288

Produtos afetados

Gallery Blocks With Lightbox

Referências · 5

• https://plugins.trac.wordpress.org/browser/simply-gallery-block/tags/3.2.8/plugin.php#L593 · Nota
• https://plugins.trac.wordpress.org/changeset/3418101/simply-gallery-block/trunk/plugin.php?old=3415010&old_path=simply-gallery-block%2Ftrunk%2Fplugin.php · Nota
• https://twitter.com/CVEnew/status/1999865362452709517 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14288 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/60ab0311-888c-46ae-98fe-9e7d4dfe13bf?source=cve · Nota