CVE-2025-14288: 
WordPress vulnerability analysis and mitigation

CVE-2025-14288 is a Missing Authorization vulnerability in the "Gallery Blocks with Lightbox" WordPress plugin (also known as Simply Gallery Block) that allows authenticated attackers with Contributor-level access or above to modify arbitrary plugin settings. The flaw affects all versions up to and including 3.3.0. It was published on December 13, 2025, with the CVE assigned by Wordfence. The CVSS v3.1 base score is 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is an improper capability check (CWE-862: Missing Authorization) in the pgc_sgb_action_wizard AJAX handler. Specifically, the plugin uses the edit_posts capability — which is granted to Contributors and above — instead of the more restrictive manage_options capability when processing the update_option action type. This allows any authenticated user with at least Contributor-level access to send crafted AJAX requests to modify any plugin setting prefixed with pgc_sgb_*, without requiring administrative privileges. The vulnerable code path is visible in the plugin source at version 3.2.8 and was patched in a subsequent changeset (Wordfence, Plugin Trac).

Successful exploitation allows an authenticated attacker with minimal privileges (Contributor role) to modify plugin configuration settings prefixed with pgc_sgb_*, impacting the integrity of the plugin's behavior on the affected WordPress site. There is no direct confidentiality or availability impact per the CVSS assessment. While the scope is limited to plugin settings, manipulation of gallery or lightbox configurations could be used to inject malicious URLs or alter content presentation for site visitors (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14288. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the "Gallery Blocks with Lightbox" plugin (simply-gallery-block) at version 3.3.0 or earlier, using tools like WPScan or by inspecting plugin metadata in page source.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious AJAX Request: Authenticate to the WordPress site and send a crafted HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the pgc_sgb_action_wizard handler with action_type=update_option.
4. Modify Plugin Settings: Include the desired pgc_sgb_* option name and value in the POST body. Because the handler only checks edit_posts (a Contributor-level capability), the request will be accepted and the setting will be updated.
5. Achieve Objective: Leverage the modified settings to alter gallery behavior, inject malicious content URLs, or otherwise manipulate the plugin's output for site visitors (Wordfence, Plugin Trac).

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php with parameters referencing pgc_sgb_action_wizard and action_type=update_option from low-privilege user accounts.
• Database: Unexpected changes to WordPress options table (wp_options) for entries with the pgc_sgb_ prefix, particularly if modified by non-administrator users.
• Logs: WordPress debug or audit logs (if enabled) recording option value changes for pgc_sgb_* settings outside of normal administrative activity.

Users should update the "Gallery Blocks with Lightbox" plugin to version 3.3.1 or later, which corrects the capability check in the pgc_sgb_action_wizard AJAX handler to use manage_options instead of edit_posts. The fix is documented in the plugin's changeset on the WordPress plugin repository. As a temporary workaround, site administrators can restrict Contributor-level user registration or remove untrusted Contributor accounts until the patch is applied (Plugin Trac Changeset, Wordfence).