平台
wordpress
组件
gallery-photo-gallery
修复版本
6.4.9
CVE-2025-13685 describes a Cross-Site Request Forgery (CSRF) vulnerability discovered in the Photo Gallery by Ays WordPress plugin. This flaw allows unauthenticated attackers to potentially manipulate gallery data, such as deleting, publishing, or unpublishing galleries, by tricking administrators into performing actions. The vulnerability impacts versions from 0.0.0 up to and including 6.4.8, and a fix is available in version 6.4.9.
The primary impact of this CSRF vulnerability lies in the potential for unauthorized modification of gallery data. An attacker could craft malicious links or embed them in websites or emails, enticing an administrator to click them. Upon clicking, the attacker's forged request would be executed with the administrator's privileges, leading to unintended actions on the gallery. This could result in data loss, disruption of service, or even the compromise of sensitive information if galleries contain confidential content. The attack surface is broad, as any administrator with access to the plugin's bulk action functionality is potentially vulnerable.
This vulnerability was publicly disclosed on December 2, 2025. As of this date, there are no known public Proof-of-Concept (PoC) exploits available. The vulnerability is not currently listed on the CISA KEV catalog. The CVSS score of 4.3 indicates a medium level of severity, suggesting a moderate probability of exploitation if the vulnerability is actively targeted.
WordPress websites utilizing the Photo Gallery by Ays plugin, particularly those with administrator accounts that are frequently targeted by phishing or social engineering attacks, are at significant risk. Shared hosting environments where multiple websites share the same server infrastructure could also be affected if one site is compromised, potentially leading to lateral movement.
• wordpress / composer / npm:
grep -r 'process_bulk_action()' /var/www/html/wp-content/plugins/photo-gallery-by-ays/• wordpress / composer / npm:
wp plugin list --status=inactive | grep 'photo-gallery-by-ays'• wordpress / composer / npm:
wp plugin update photo-gallery-by-ays --alldisclosure
漏洞利用状态
EPSS
0.03% (9% 百分位)
CISA SSVC
CVSS 向量
The most effective mitigation is to immediately upgrade the Photo Gallery by Ays plugin to version 6.4.9 or later. This version includes the necessary nonce verification to prevent CSRF attacks. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with CSRF protection rules specifically targeting the plugin's endpoints. Additionally, educate administrators about the risks of clicking on suspicious links and encourage them to verify the authenticity of any requests before executing them. Regularly review WordPress user permissions to ensure least privilege access.
更新至 6.4.9 版本，或更新的修复版本
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-13685 is a Cross-Site Request Forgery (CSRF) vulnerability in the Photo Gallery by Ays WordPress plugin, allowing attackers to perform unauthorized gallery actions.
You are affected if you are using Photo Gallery by Ays WordPress plugin versions 0.0.0 through 6.4.8.
Upgrade the Photo Gallery by Ays plugin to version 6.4.9 or later to resolve the vulnerability. Consider WAF rules as a temporary workaround.
As of December 2, 2025, there are no confirmed reports of active exploitation, but the vulnerability is publicly known.
Refer to the plugin developer's website or the WordPress plugin repository for the official advisory and update information.
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。