CVE-2025-12494: 
WordPress Analyse et atténuation des vulnérabilités

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaximportfile function in all versions up to, and including, 2.12.28. This vulnerability was discovered and disclosed on November 15, 2025 (NVD).

The vulnerability exists in the ajaximportfile function where authenticated attackers with author-level access or above can move arbitrary image files on the server due to insufficient file path validation. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and is classified under CWE-285 (Improper Authorization) (NVD).

The vulnerability allows authenticated attackers with author-level privileges to move arbitrary image files on the server, potentially leading to unauthorized file manipulation (NVD).

Users should update to a version newer than 2.12.28 once available. Until then, it is recommended to restrict author-level access to trusted users only (NVD).