CVE-2025-13685: CSRF in Photo Gallery by Ays WordPress Plugin

The primary impact of this CSRF vulnerability lies in the potential for unauthorized modification of gallery data. An attacker could craft malicious links or embed them in websites or emails, enticing an administrator to click them. Upon clicking, the attacker's forged request would be executed with the administrator's privileges, leading to unintended actions on the gallery. This could result in data loss, disruption of service, or even the compromise of sensitive information if galleries contain confidential content. The attack surface is broad, as any administrator with access to the plugin's bulk action functionality is potentially vulnerable.

1. Reserved2025-11-25
2. Published2025-12-02
3. Modified2026-04-08
4. EPSS updated2026-03-23

The most effective mitigation is to immediately upgrade the Photo Gallery by Ays plugin to version 6.4.9 or later. This version includes the necessary nonce verification to prevent CSRF attacks. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with CSRF protection rules specifically targeting the plugin's endpoints. Additionally, educate administrators about the risks of clicking on suspicious links and encourage them to verify the authenticity of any requests before executing them. Regularly review WordPress user permissions to ensure least privilege access.

Active installs

2KKnown

Plugin rating