PT-2025-30003 · WordPress · Block Editor Gallery Slider

Phong Nguyen · Published 2025-07-18 · Updated 2025-07-18 · CVE-2025-6726

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Block Editor Gallery Slider plugin for WordPress versions up to and including 1.1.1

Description The Block Editor Gallery Slider plugin for WordPress is susceptible to unauthorized data modification. A missing capability check within the classic gallery slider options() function allows authenticated attackers with Subscriber-level access or higher to update limited post meta for any post.

Recommendations Update the Block Editor Gallery Slider plugin to a version later than 1.1.1.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-6726

Affected Products

Block Editor Gallery Slider

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-6726 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3331844%40block-editor-gallery-slider&new=3331844%40block-editor-gallery-slider&sfp_email=&sfph_mail= · Note
• https://wordpress.org/plugins/block-editor-gallery-slider · Note
• https://t.me/cvetracker/28113 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1946106521055547805 · Twitter Post
• https://twitter.com/CVEnew/status/1946085262825787598 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/770b0401-4d05-476e-a2b1-e9e9c920f5fa?source=cve · Note