What is CVE-2025-14455?

CVE-2025-14455 is a medium-severity vulnerability in Wpchill Image Photo Gallery Final Tiles Grid, classified under Missing Authorization. CVSS score: 5.4/10. Published 2025-12-19.

How severe is CVE-2025-14455?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Auth bypass in Wpchill Image Photo Gallery Final Tiles Grid

CVE-2025-14455

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete, modify, or clone galleries created by any user, including administrators.

Vulnerability class: Broken Access Control

EPSS: 0.003 (17.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.

Affected products

Wpchill Image Photo Gallery Final Tiles Grid — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2025-14455?: CVE-2025-14455 is a medium-severity vulnerability in Wpchill Image Photo Gallery Final Tiles Grid, classified under Missing Authorization. CVSS score: 5.4/10. Published 2025-12-19.
How severe is CVE-2025-14455?: Medium severity. CVSS v3 base score is 5.4 out of 10.