CVE-2025-31732: 
WordPress vulnerability analysis and mitigation

Missing Authorization vulnerability identified in gb-plugins GB Gallery Slideshow (CVE-2025-31732) affects versions through 1.3. The vulnerability was discovered and disclosed on April 1, 2025, impacting the WordPress plugin's access control security levels (Patchstack).

The vulnerability is classified as a broken access control issue due to missing authorization, authentication, or nonce token checks in certain functions. It has been assigned a CVSS v3.1 score of 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is tracked under CWE-862 (Missing Authorization) (NVD).

The vulnerability allows unprivileged users to execute certain higher privileged actions within the GB Gallery Slideshow plugin. The impact is considered low severity but could lead to unauthorized access control manipulation (Patchstack).

The vulnerability requires a low privilege level (Subscriber) to exploit, with low attack complexity. The attack can be launched remotely, though user interaction is not required. There is no evidence of active exploitation in the wild (Patchstack).

No official fix is currently available for this vulnerability. As the software is considered abandoned (last updated over a year ago), users are strongly advised to remove and replace the plugin with an alternative solution (Patchstack).