PT-2026-3517 · WordPress · Image Photo Gallery Final Tiles Grid

Pouria Shahba · Published 2026-01-19 · Updated 2026-01-20 · CVE-2025-15466

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Image Photo Gallery Final Tiles Grid plugin for WordPress versions through 3.6.9

Description The software is susceptible to unauthorized access and modification of data because of absent capability checks on several AJAX actions. Authenticated attackers possessing Contributor-level access or higher can view, create, modify, clone, delete, and reassign ownership of galleries, even those created by administrators. The affected AJAX actions do not properly verify user permissions before allowing operations on gallery data.

Recommendations Update the Image Photo Gallery Final Tiles Grid plugin to a version beyond 3.6.9.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-15466

Affected Products

Image Photo Gallery Final Tiles Grid

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-15466 · Security Note
• https://twitter.com/CVEnew/status/2013395184675921995 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2013513732060487816 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0afcfe15-2d7d-4c96-a408-28f35577a927?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3435746 · Note