CVE-2025-12494

14th percentile - higher than 14% of all known CVEs

The WordPress plugin Image Gallery – Photo Grid & Video Gallery is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_import_file function in all versions up to and including 2.12.28. Authenticated attackers with author-level access and above can move arbitrary image files on the server.

An attacker with author-level access can move or delete files on the server, potentially leading to data loss or site disruption. The risk affects sites with the vulnerable plugin version and accounts with elevated privileges.

Update the Image Gallery – Photo Grid & Video Gallery plugin to a version newer than 2.12.28. Until the update, limit the number of accounts with author-level and higher privileges and consider disabling the file import function.