PT-2026-20577 · WordPress · Acf Photo Gallery Field

Rafshanzani Suhada · Publicado 2026-02-19 · Atualizado 2026-02-23 · CVE-2025-12081

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ACF Photo Gallery Field versions prior to 3.1

Description The ACF Photo Gallery Field plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check within the acf photo gallery edit save function. Authenticated attackers with subscriber-level access or higher can modify the title, caption, and custom metadata of media attachments.

Recommendations Update ACF Photo Gallery Field to version 3.1 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-12081

Produtos afetados

Acf Photo Gallery Field

Referências · 7

• https://twitter.com/CVEnew/status/2025892087586042032 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/d52a1c67-e20d-4390-9d07-94337a31d193?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-12081 · Nota de Segurança
• https://t.me/CVEtracker/45064 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/navz-photo-gallery/tags/3.0/navz-photo-gallery.php#L173 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3428006%40navz-photo-gallery&new=3428006%40navz-photo-gallery&sfp_email=&sfph_mail= · Nota
• https://plugins.trac.wordpress.org/browser/navz-photo-gallery/tags/3.0/includes/acf_photo_gallery_edit_save.php#L8 · Nota