CVE-2025-13685: 
WordPress vulnerability analysis and mitigation

CVE-2025-13685 is a Cross-Site Request Forgery (CSRF) vulnerability in the Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress, affecting all versions up to and including 6.4.8. The flaw stems from missing nonce verification in the process_bulk_action() function's bulk action functionality, enabling unauthenticated attackers to perform bulk gallery operations (delete, publish, or unpublish) by tricking an administrator into clicking a malicious link. It was published on December 2, 2025, with a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-352 (Cross-Site Request Forgery), specifically the absence of WordPress nonce verification in the process_bulk_action() function located in includes/lists/class-gallery-photo-gallery-list-table.php. Because no nonce is checked before processing bulk administrative actions, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator (e.g., via a malicious link or embedded iframe), executes bulk operations against the gallery management interface. The fix was introduced in version 6.4.9, as confirmed by the plugin's changeset (Plugin Changeset).

Successful exploitation allows an unauthenticated attacker to manipulate gallery content on affected WordPress sites by deleting, publishing, or unpublishing galleries without authorization. The primary impact is on integrity — gallery data can be permanently deleted or its visibility altered, potentially causing data loss and disrupting site content. Confidentiality and availability are not directly impacted, but content destruction could have significant operational consequences for sites relying on the gallery plugin (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-13685. The vulnerability requires social engineering — an administrator must be tricked into clicking a crafted link or visiting a malicious page while authenticated. The EPSS score is approximately 0.022%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites using the Photo Gallery by Ays plugin (versions ≤ 6.4.8) via passive enumeration (e.g., checking readme.txt or plugin metadata in page source).
2. Craft malicious request: Construct a forged HTTP POST or GET request targeting the WordPress admin gallery management page (e.g., wp-admin/admin.php?page=gallery-photo-gallery) with bulk action parameters (e.g., action=delete, gallery_ids[]=<id>) that would normally require a valid nonce.
3. Deliver payload: Embed the forged request in a malicious webpage (e.g., as a hidden form with auto-submit JavaScript) or disguise it as a legitimate link in a phishing email targeting the site administrator.
4. Trigger execution: When the authenticated administrator visits the attacker-controlled page or clicks the link, the browser automatically sends the forged request with the administrator's session cookies, causing the bulk action (delete/publish/unpublish) to execute without nonce validation (Wordfence, Plugin Changeset).

• Logs: WordPress access logs showing unexpected POST requests to wp-admin/admin.php?page=gallery-photo-gallery with bulk action parameters (e.g., action=delete, action=publish) from unusual referrer URLs or external domains.
• Application Events: WordPress admin audit logs (if enabled) recording bulk gallery deletions, publications, or unpublications performed by an administrator account at unusual times or from unexpected IP addresses.
• File System: No direct file system artifacts are expected, but sudden disappearance of gallery entries in the WordPress database (wp_posts or plugin-specific tables) without corresponding admin activity may indicate exploitation.

Update the Photo Gallery by Ays plugin to version 6.4.9 or later, which introduces proper nonce verification in the process_bulk_action() function. No configuration-based workaround is available; upgrading is the only effective remediation. As a general precaution, administrators should avoid clicking unsolicited links while logged into the WordPress admin panel and consider using security plugins that add additional CSRF protections (Wordfence, Plugin Changeset).

The vulnerability was discovered and disclosed by Wordfence, which assigned the CVE and published the advisory. Coverage has been limited to automated vulnerability tracking platforms (VulDB, Vulners, CVEFeed, CIRCL) and a brief mention on Bluesky's CVE feed. No significant researcher commentary or broader media coverage has been identified for this medium-severity issue.