CVE-2025-14003: 
WordPress vulnerability analysis and mitigation

CVE-2025-14003 is a missing authorization vulnerability in the Image Gallery – Photo Grid & Video Gallery (Modula) plugin for WordPress, allowing authenticated attackers to add images to galleries they do not own. It affects all plugin versions up to and including 2.13.3, and was disclosed on December 15, 2025, with the CVE assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the add_images_to_gallery_callback() AJAX function within the Modula plugin. Because no authorization check verifies whether the requesting user owns or has permission to modify a target gallery, any authenticated WordPress user with Author-level access or higher can supply an arbitrary gallery ID and inject images into it. The attack is network-accessible, requires no user interaction, and has low attack complexity — the attacker simply needs a valid WordPress account (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to modify the content of any Modula gallery on the WordPress site, regardless of ownership — an unauthorized integrity impact. While confidentiality and availability are unaffected, an attacker could inject inappropriate, misleading, or malicious images into galleries belonging to other users or administrators, potentially damaging site reputation or facilitating social engineering. The scope is limited to the WordPress installation hosting the vulnerable plugin (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-14003. The EPSS score is approximately 0.026%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum an Author-level WordPress account, limiting the attacker pool to authenticated users (Wordfence, Red Hat CVE).

1. Obtain authenticated access: Register or compromise a WordPress account with at least Author-level privileges on the target site running Modula Image Gallery ≤ 2.13.3.
2. Identify target gallery IDs: Browse the site or use the WordPress REST API / admin panel to enumerate gallery post IDs belonging to other users.
3. Craft a malicious AJAX request: Send an authenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) invoking the add_images_to_gallery_callback() action, supplying the target gallery's ID and the desired image attachment IDs in the request body.
4. Confirm unauthorized modification: Verify that the specified images now appear in the victim's gallery, confirming the missing authorization check was bypassed (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to /wp-admin/admin-ajax.php with an action parameter corresponding to the Modula gallery image-add callback, originating from user accounts that do not own the targeted gallery.
• Database: Unexpected changes to Modula gallery post meta or attachment relationships in the wp_postmeta table, where the gallery post author differs from the user who made the modification.
• Application Logs: WordPress debug logs recording calls to add_images_to_gallery_callback() by low-privileged users against galleries they do not own.

Update the Modula Image Gallery plugin to version 2.13.4 or later, which introduces the missing capability check in add_images_to_gallery_callback(). The fix is available via the WordPress Plugin Repository changeset (WordPress Trac). As a temporary workaround, site administrators can restrict Author-level user registration or limit trusted users to the minimum necessary roles until the patch is applied. Regularly auditing gallery content for unexpected image additions can help detect exploitation attempts in the interim.

Sucuri included CVE-2025-14003 in its December 2025 vulnerability patch roundup, noting it as one of several WordPress plugin issues addressed that month (Sucuri Blog). Coverage has otherwise been limited to automated vulnerability aggregators and databases, with no significant researcher commentary or social media discussion observed.