CVE-2025-12377

Root

Cause

The vulnerability resides in the AJAX handler envira_gallery_remove_image(), which only checks the broad edit_posts capability instead of verifying object-level permissions on the target gallery. This missing authorization check allows any user with Author-level access to invoke the function without owning the gallery [1].

Exploitation

An authenticated attacker with Author-level privileges can craft AJAX requests to remove images from any Envira gallery, regardless of ownership. No additional authentication or network position is required beyond a valid WordPress session with Author capabilities [1].

Impact

Successful exploitation leads to unauthorized removal of images from arbitrary galleries, resulting in visual defacement and loss of content integrity. This can disrupt portfolios, product pages, and editorial content that rely on gallery composition [1].

Mitigation

The issue was partially patched in version 1.12.0 of the plugin. Users are advised to update to the latest available version. As of publication, no active exploits have been reported in the wild [1].