CVE-2025-63014: CSRF in Gmedia Photo Gallery WordPress Plugin

The CSRF vulnerability allows an attacker to trick a logged-in user into unknowingly performing actions they didn't intend. For example, an attacker could craft a malicious link that, when clicked, modifies gallery settings, deletes images, or performs other administrative actions. The impact is amplified if the attacker can target users with administrative privileges, potentially leading to complete site compromise. This vulnerability is similar to other CSRF attacks, where the attacker leverages the user's authenticated session to execute malicious requests.

1. Reserved2025-10-24
2. Published2025-12-31
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation is to upgrade the Gmedia Photo Gallery plugin to a version that addresses this vulnerability. If immediate upgrading is not possible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) with CSRF protection rules. Additionally, carefully review and restrict user permissions to minimize the potential impact of a successful attack. Implement strict input validation and output encoding practices within the plugin itself to prevent future CSRF vulnerabilities. After upgrade, confirm by reviewing the plugin's changelog and testing core functionality.

Active installs

8KNiche

Plugin rating