CVE-2025-12377: 
WordPress vulnerability analysis and mitigation

CVE-2025-12377 is a Missing Authorization vulnerability in the Envira Photo Gallery plugin for WordPress ("Gallery Plugin for WordPress – Envira Photo Gallery") that allows authenticated attackers with Author-level access or above to perform unauthorized data modification actions, such as removing images from arbitrary galleries. The vulnerability affects all versions up to and including 1.12.0, with only a partial patch applied in version 1.12.0. It was published on November 13, 2025, and assigned a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): several functions in the plugin's includes/admin/ajax.php file lack proper capability checks before executing privileged operations (EUVD, CleanTalk Research). An attacker with at least Author-level WordPress credentials can send crafted AJAX requests to these unprotected endpoints, triggering actions such as removing images from galleries they do not own. The attack requires network access and low privileges but no user interaction, making it straightforward to exploit in multi-author WordPress environments. The partial patch in version 1.12.0 addressed some but not all affected functions, leaving residual risk (WordPress Trac).

Successful exploitation allows authenticated attackers to modify gallery data across the WordPress site without authorization, including removing images from galleries they do not manage. The primary impact is on data integrity; there is no confidentiality or availability impact based on the CVSS assessment. In multi-author or contributor-heavy WordPress deployments, this could result in unauthorized content manipulation, defacement of gallery pages, or disruption of media-dependent workflows (Wordfence, EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-12377. The EPSS score is approximately 0.033% (0.000330), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum an authenticated Author-level account on the target WordPress site, limiting the attacker pool compared to unauthenticated vulnerabilities (Wordfence, Wordfence Weekly Report).

1. Reconnaissance: Identify WordPress sites running the Envira Photo Gallery plugin (versions ≤1.12.0) by inspecting page source for plugin-specific assets or using tools like WPScan.
2. Obtain Author-level access: Register or compromise an account with at least Author-level privileges on the target WordPress site.
3. Identify vulnerable AJAX endpoints: Review the plugin's includes/admin/ajax.php to identify AJAX action hooks that lack current_user_can() or equivalent capability checks (WordPress Trac).
4. Craft malicious AJAX request: Send a POST request to wp-admin/admin-ajax.php with the appropriate action parameter targeting a vulnerable function (e.g., image removal), including the nonce and target gallery/image IDs.
5. Achieve unauthorized modification: The server processes the request without verifying the requester's ownership or capability, resulting in removal of images from arbitrary galleries (CleanTalk Research).

• Logs: WordPress access logs showing POST requests to wp-admin/admin-ajax.php with gallery-related action parameters (e.g., envira_gallery_remove_image) originating from Author-level user accounts that do not own the targeted galleries.
• Application Logs: Unexpected gallery modification events (image deletions) in WordPress activity logs or audit plugins, particularly across galleries not associated with the acting user.
• Database: Unexplained removal of image entries from the envira_gallery post meta or related tables, especially if correlated with Author-level user activity.
• Network: Repeated AJAX requests to admin-ajax.php from the same authenticated session targeting multiple different gallery IDs in a short timeframe.

Site administrators should update the Envira Photo Gallery plugin to the latest available version beyond 1.12.0, as version 1.12.0 only partially addressed the vulnerability. A subsequent changeset (3394455) was applied to further remediate the missing capability checks (WordPress Trac Changeset). As an interim measure, administrators should restrict Author-level and Contributor-level user accounts to trusted individuals only, and consider using a WordPress security plugin (e.g., Wordfence) to monitor and block suspicious AJAX activity (Sucuri Roundup).

Wordfence included CVE-2025-12377 in its weekly WordPress vulnerability report for November 10–16, 2025, noting the partial patch status and residual risk (Wordfence Weekly Report). Sucuri also highlighted the vulnerability in its November 2025 patch roundup, advising WordPress site owners to update affected plugins promptly (Sucuri Roundup). No significant social media controversy or broader media coverage has been observed beyond standard security community reporting.