CVE-2025-14170

Summary

The Vimeo SimpleGallery plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 0.2. This is due to missing authorization checks on the vimeogallery_admin function hooked to admin_menu. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary plugin settings via the action parameter.

Affected Software

Weaknesses

• CWE-862: CWE-862 Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb28557-7023-481f-a05b-0b9a22d7a456?source=cve
• https://plugins.trac.wordpress.org/browser/vimeo-simplegallery/trunk/vimeo_simplegallery.php#L22
• https://plugins.trac.wordpress.org/browser/vimeo-simplegallery/tags/0.2/vimeo_simplegallery.php#L22

• ←Previous
• Next→