PT-2025-52438 · WordPress · Image Photo Gallery Final Tiles Grid

Jonghwan Shin · Published 2025-12-19 · Updated 2025-12-19 · CVE-2025-14455

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Image Photo Gallery Final Tiles Grid plugin for WordPress versions up to and including 3.6.7

Description The Image Photo Gallery Final Tiles Grid plugin for WordPress does not properly verify user authorization for gallery management functions. This allows authenticated attackers with Contributor-level access or higher to delete, modify, or clone galleries created by any user, including administrators.

Recommendations Update the Image Photo Gallery Final Tiles Grid plugin to a version later than 3.6.7.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14455

Affected Products

Image Photo Gallery Final Tiles Grid

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-14455 · Security Note
• https://plugins.trac.wordpress.org/browser/final-tiles-grid-gallery-lite/tags/3.6.7/FinalTilesGalleryLite.php#L213 · Note
• https://plugins.trac.wordpress.org/changeset/3417363/final-tiles-grid-gallery-lite/trunk/FinalTilesGalleryLite.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/830663b6-0786-48c7-9ffd-ac3ba2bd3e0c?source=cve · Note
• https://plugins.trac.wordpress.org/browser/final-tiles-grid-gallery-lite/tags/3.6.7/FinalTilesGalleryLite.php#L528 · Note
• https://t.me/CVEtracker/40265 · Telegram Post
• https://twitter.com/CVEnew/status/2002099162888966644 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2002122972052570193 · Twitter Post
• https://t.me/cveNotify/146312 · Telegram Post
• https://plugins.trac.wordpress.org/browser/final-tiles-grid-gallery-lite/tags/3.6.7/FinalTilesGalleryLite.php#L684 · Note