CVE-2026-25375: 
WordPress vulnerability analysis and mitigation

CVE-2026-25375 is a Missing Authorization vulnerability in the WP Chill "Image Photo Gallery Final Tiles Grid" WordPress plugin (plugin slug: final-tiles-grid-gallery-lite). It allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. The vulnerability affects all versions of the plugin through 3.6.10. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that a requesting user has the necessary permissions before executing certain actions. The attack vector is network-based, requires low privileges (authenticated user), no user interaction, and low attack complexity. This type of broken access control flaw typically arises when WordPress AJAX handlers or REST API endpoints lack proper capability checks (e.g., current_user_can()), allowing lower-privileged users to trigger functionality intended for administrators (Feedly, Patchstack).

Successful exploitation results in a limited availability impact (CVSS availability impact: Low), with no direct confidentiality or integrity impact according to the CVSS scoring. An authenticated attacker with minimal privileges (e.g., a subscriber-level WordPress account) could abuse the missing authorization check to trigger restricted plugin functionality, potentially disrupting gallery operations or causing unintended plugin behavior. The scope is unchanged, limiting the blast radius to the affected plugin's functionality on the target WordPress installation (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been identified for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a low-privileged authenticated account on the target WordPress site, which limits opportunistic mass exploitation (Feedly).

1. Reconnaissance: Identify WordPress sites running the "Image Photo Gallery Final Tiles Grid" plugin (slug: final-tiles-grid-gallery-lite) version 3.6.10 or earlier using tools like WPScan or by checking /wp-content/plugins/final-tiles-grid-gallery-lite/ for version information.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged WordPress account (e.g., subscriber role) on the target site.
3. Identify unprotected endpoints: Enumerate WordPress AJAX actions or REST API endpoints registered by the plugin that lack proper current_user_can() capability checks.
4. Send unauthorized request: Craft and send an authenticated HTTP request (with valid nonce/cookie) to the identified endpoint, invoking restricted plugin functionality without the required administrative privileges.
5. Achieve objective: Trigger the unprotected action to cause the availability impact described in the vulnerability (e.g., disrupting gallery settings or plugin state) (Feedly).

• Logs: WordPress access logs showing repeated POST requests to wp-admin/admin-ajax.php or REST API endpoints associated with the final-tiles-grid-gallery-lite plugin from low-privileged user accounts.
• Logs: Unusual plugin-related actions in WordPress debug logs (wp-content/debug.log) triggered by non-administrator users.
• Network: Authenticated HTTP requests from unexpected IP addresses targeting plugin-specific AJAX actions on the WordPress installation.

Users should update the "Image Photo Gallery Final Tiles Grid" plugin to a version beyond 3.6.10 that includes the authorization fix. Check the WordPress plugin repository or the WP Chill vendor page for the latest patched release. As a temporary workaround, site administrators can restrict plugin access by limiting user registration or removing untrusted low-privileged accounts until a patch is applied. Web application firewalls (WAF) with WordPress rulesets may also help detect and block unauthorized requests to plugin endpoints (Patchstack).