CVE-2026-25363: 
WordPress vulnerability analysis and mitigation

CVE-2026-25363 is a Missing Authorization vulnerability in the FooPlugins FooGallery WordPress plugin that allows authenticated attackers to exploit incorrectly configured access control security levels. It affects FooGallery versions up to and including 3.1.11. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that an authenticated user has the appropriate permissions before performing certain actions. An attacker with low-privileged network access (e.g., a subscriber-level WordPress account) can exploit this flaw without user interaction to perform unauthorized operations. The attack vector is network-based with low complexity and no privilege escalation beyond the initial authenticated session (Feedly, Patchstack).

Successful exploitation results in a limited integrity impact — an authenticated low-privileged attacker can perform unauthorized actions within the FooGallery plugin, such as modifying gallery settings or data they should not have access to. There is no confidentiality or availability impact associated with this vulnerability. The scope is unchanged, meaning the impact is confined to the vulnerable component itself (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-25363. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users should update the FooGallery WordPress plugin to a version beyond 3.1.11 as soon as a patched release is made available by FooPlugins. In the interim, site administrators should restrict plugin access to trusted users only and review WordPress user roles to minimize the number of accounts with any elevated permissions. Monitoring the WordPress admin panel for unexpected changes to gallery configurations may help detect unauthorized activity (Patchstack).