Skip to content
Sign in
4.3 Medium

CVE-2025-15524 The Gallery by FooGallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing…

Description

The Gallery by FooGallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax_get_gallery_info() function in all versions up to, and including, 3.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve metadata (name, image count, thumbnail URL) of private, draft, and password-protected galleries by enumerating gallery IDs.

Affected products and versions

Product Affected versions Fixed in
Gallery by FooGallery 3.1 earliest → 3.1.9 No fix stated

Other CVEs of Gallery by FooGallery

The 11 CVEs of Gallery by FooGallery →
CVE-2024-13362 Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in… 6.1 Medium CVE-2025-6068 The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is… 6.4 Medium CVE-2024-12114 The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is… 4.3 Medium CVE-2024-12119 The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is… 6.4 Medium
Track this CVE