PT-2025-51064 · WordPress · Gallery Blocks With Lightbox

Karol Paciorek · Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-14288

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Gallery Blocks with Lightbox versions prior to 3.3.1

Description The Gallery Blocks with Lightbox WordPress plugin is susceptible to unauthorized modification of plugin settings. This occurs because the plugin incorrectly uses the edit posts capability check instead of manage options for the update option action type within the pgc sgb action wizard AJAX handler. Authenticated attackers possessing Contributor-level access or higher can modify arbitrary plugin settings prefixed with pgc sgb *.

Recommendations Update The Gallery Blocks with Lightbox to version 3.3.1 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14288

Affected Products

Gallery Blocks With Lightbox

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-14288 · Security Note
• https://plugins.trac.wordpress.org/browser/simply-gallery-block/tags/3.2.8/plugin.php#L593 · Note
• https://plugins.trac.wordpress.org/changeset/3418101/simply-gallery-block/trunk/plugin.php?old=3415010&old_path=simply-gallery-block%2Ftrunk%2Fplugin.php · Note
• https://twitter.com/CVEnew/status/1999865362452709517 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/60ab0311-888c-46ae-98fe-9e7d4dfe13bf?source=cve · Note