CVE-2025-13685: Photo Gallery by Ays <= 6.4.8 - Cross-Site Request Forgery to Bulk Actions
The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8. This is due to missing nonce verification on the bulk action functionality in the 'processbulkaction()' function. This makes it possible for unauthenticated attackers to perform bulk operations (delete, publish, or unpublish galleries) via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13685?
CVE-2025-13685 is classified as a medium severity vulnerability due to its potential to allow unauthorized actions through cross-site request forgery.
How do I fix CVE-2025-13685?
To fix CVE-2025-13685, update the Photo Gallery by Ays plugin to version 6.4.9 or later to ensure nonce verification is implemented.
What versions of the Photo Gallery by Ays plugin are affected by CVE-2025-13685?
CVE-2025-13685 affects all versions of the Photo Gallery by Ays plugin up to and including 6.4.8.
What functionality does CVE-2025-13685 impact?
CVE-2025-13685 impacts the bulk action functionality in the process_bulk_action() function of the plugin.
What kind of attack can CVE-2025-13685 enable?
CVE-2025-13685 can enable cross-site request forgery attacks, allowing unauthorized actions to be performed on behalf of an authenticated user.