PT-2026-20577 · WordPress · Acf Photo Gallery Field

Rafshanzani Suhada · Published 2026-02-19 · Updated 2026-02-23 · CVE-2025-12081

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ACF Photo Gallery Field versions prior to 3.1

Description The ACF Photo Gallery Field plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check within the acf photo gallery edit save function. Authenticated attackers with subscriber-level access or higher can modify the title, caption, and custom metadata of media attachments.

Recommendations Update ACF Photo Gallery Field to version 3.1 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12081

Affected Products

Acf Photo Gallery Field

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12081 · Security Note
• https://twitter.com/CVEnew/status/2025892087586042032 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d52a1c67-e20d-4390-9d07-94337a31d193?source=cve · Note
• https://t.me/CVEtracker/45064 · Telegram Post
• https://plugins.trac.wordpress.org/browser/navz-photo-gallery/tags/3.0/navz-photo-gallery.php#L173 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3428006%40navz-photo-gallery&new=3428006%40navz-photo-gallery&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/navz-photo-gallery/tags/3.0/includes/acf_photo_gallery_edit_save.php#L8 · Note