CVE-2025-49394: 
WordPress vulnerability analysis and mitigation

The CVE-2025-49394 is a Missing Authorization vulnerability affecting the Image Gallery Block – Create and Display Photo Galleries plugin for WordPress in versions up to and including 1.0.7. The vulnerability was discovered on August 26, 2025, and publicly disclosed on November 6, 2025 (Rapid7, AttackerKB).

The vulnerability is classified as a Missing Authorization issue with a CVSS score of 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N). The security flaw stems from missing capability checks on several functions, which allows authenticated users with Subscriber-level access and above to perform unauthorized actions (Rapid7).

When exploited, this vulnerability allows authenticated attackers with Subscriber-level access to view and activate plugins, potentially compromising the security of the WordPress installation. The impact is particularly concerning as it enables lower-privileged users to perform actions typically restricted to administrators (Patchstack).

Users are advised to update to version 2.0.0 or later of the Image Gallery Block plugin, which contains the fix for this vulnerability. For those unable to update immediately, implementing strict user access controls and monitoring plugin activation activities is recommended (Patchstack).