CVE-2025-64254

LowCVSS 2.7

Published: 09/12/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The Photo Block plugin by Ronald Huereca up to version 1.5.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects all versions from n/a through 1.5.1.

Risk Assessment

The risk includes the possibility of unauthorized access to plugin functionality, which could lead to content modification, data theft, or privilege escalation.

Recommendation

It is recommended to immediately update the plugin to a version newer than 1.5.1 if available, and to review access control configurations.

Other vulnerabilities in Photo Block

CVE-2026-24639Medium
The Photo Block plugin versions up to 1.7.1 contain a Server-Side Request Forgery (SSRF) vulnerability, allowing authors to send requests to internal network resources.

Original NVD description (English source)

Missing Authorization vulnerability in Ronald Huereca Photo Block photo-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Block: from n/a through <= 1.5.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS