CVE-2025-14455: 
WordPress vulnerability analysis and mitigation

CVE-2025-14455 is a Missing Authorization vulnerability in the Image Photo Gallery Final Tiles Grid WordPress plugin (by WPChill/MachoThemes) that allows authenticated attackers to bypass authorization controls on gallery management functions. All versions up to and including 3.6.7 are affected. The vulnerability was published on December 19, 2025, with a CVSS v3.1 base score of 5.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to properly verify that a requesting user is authorized to perform gallery management actions before executing them. Vulnerable code paths are present in FinalTilesGalleryLite.php at lines 213, 528, and 684 in version 3.6.7, where gallery delete, modify, and clone operations lack adequate capability or ownership checks (Wordfence, WordPress Trac). The attack vector is network-based, requires low privileges (Contributor-level WordPress account or above), and no user interaction, making it straightforward to exploit from any authenticated session.

Successful exploitation allows an authenticated attacker with at least Contributor-level access to delete, modify, or clone galleries belonging to any user on the WordPress site, including those created by administrators. This primarily affects integrity (unauthorized modification or deletion of gallery content) and availability (destruction of gallery data), with no direct confidentiality impact. While the vulnerability does not enable remote code execution or privilege escalation on its own, it can be used to disrupt site content or deface gallery-based pages.

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14455 as of the available data. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid WordPress account with at least Contributor-level privileges, which limits the attacker pool but does not eliminate risk on sites with open registration or multiple contributors (Wordfence).

1. Reconnaissance: Identify WordPress sites running the "Image Photo Gallery Final Tiles Grid" plugin at version 3.6.7 or earlier, using tools like WPScan or by checking the plugin's readme.txt file at /wp-content/plugins/final-tiles-grid-gallery-lite/readme.txt.
2. Obtain Contributor Access: Register or log in as a Contributor-level (or higher) WordPress user on the target site.
3. Identify Target Galleries: Browse the site or use the WordPress admin interface to enumerate galleries created by other users, including administrators.
4. Send Unauthorized Request: Craft and send an authenticated HTTP request (e.g., POST or AJAX action) targeting the gallery management endpoints in FinalTilesGalleryLite.php (lines 213, 528, or 684) with the ID of a gallery owned by another user, specifying a delete, modify, or clone action.
5. Achieve Objective: Due to missing authorization checks, the plugin executes the requested action on the target gallery without verifying ownership, resulting in unauthorized deletion, modification, or cloning of the gallery (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST/AJAX requests to gallery management endpoints (e.g., admin-ajax.php with gallery delete/modify/clone actions) from low-privileged user accounts targeting gallery IDs not owned by that user.
• Application: Unexpected deletion, modification, or duplication of galleries in the WordPress admin panel, particularly those owned by administrators or other users.
• User Activity: Contributor-level accounts performing gallery management actions at unusual times or frequencies inconsistent with normal editorial behavior.

The vendor (WPChill) released a patch in the plugin's trunk, visible in the WordPress Trac changeset 3417363. Update the plugin to version 3.6.8 or later (the first patched release) as the primary remediation. As a temporary workaround, site administrators can restrict Contributor-level user registration or remove untrusted Contributor accounts until the update is applied. Monitoring WordPress user activity logs for unauthorized gallery management actions is also recommended during the transition period (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on December 19, 2025. Red Hat also tracked the CVE and published their entry on December 20, 2025. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified (Wordfence, Red Hat CVE).