CVE-2025-12081

Executive Summary

CVE-2025-12081 is a Missing Authorization vulnerability in the ACF Photo Gallery Field plugin for WordPress. This flaw allows authenticated attackers with subscriber-level access or higher to modify the title, caption, and custom metadata of arbitrary media attachments. The vulnerability exists in all versions up to and including 3.0, and no official patch has been released as of this analysis. The CVSS score is 4.3 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. However, given the ease of exploitation and the potential for data integrity impact, this issue warrants immediate attention.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates from the vendor and consider disabling the plugin if no patch is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires subscriber-level authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Limited modification of metadata.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the ability for low-privileged users to alter media metadata could lead to defacement or data integrity issues.

Deep Dive & Mechanics

The vulnerability resides in the acf_photo_gallery_edit_save AJAX action handler. This function is intended to allow authorized users to save edits to photo gallery items. However, the plugin fails to perform a capability check (e.g., current_user_can('edit_post')) before processing the request. As a result, any authenticated user, including subscribers, can send a crafted POST request to modify the post_title, post_excerpt, and meta_input (custom metadata) of any media attachment (post type attachment).

The vulnerable code likely resembles:

add_action('wp_ajax_acf_photo_gallery_edit_save', 'acf_photo_gallery_edit_save');
function acf_photo_gallery_edit_save() {
    // Missing capability check
    $attachment_id = intval($_POST['attachment_id']);
    $title = sanitize_text_field($_POST['title']);
    $caption = sanitize_text_field($_POST['caption']);
    $meta = $_POST['meta']; // Custom metadata

    wp_update_post(array(
        'ID' => $attachment_id,
        'post_title' => $title,
        'post_excerpt' => $caption,
    ));
    update_post_meta($attachment_id, 'custom_meta', $meta);
    wp_die();
}

The attacker only needs to know the target attachment ID and have a valid WordPress nonce (which may be exposed to subscribers via the plugin's frontend).

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.0):

add_action('wp_ajax_acf_photo_gallery_edit_save', 'acf_photo_gallery_edit_save');
function acf_photo_gallery_edit_save() {
    // No capability check
    $attachment_id = intval($_POST['attachment_id']);
    // ... process and update
}

Patched Code (Hypothetical):

add_action('wp_ajax_acf_photo_gallery_edit_save', 'acf_photo_gallery_edit_save');
function acf_photo_gallery_edit_save() {
    // Verify user can edit the attachment
    if (!current_user_can('edit_post', intval($_POST['attachment_id']))) {
        wp_die('Unauthorized', 403);
    }
    // ... rest of the function
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: A WordPress site with the ACF Photo Gallery Field plugin (<= 3.0) and a subscriber account.
2. Steps:
   • Log in as a subscriber and obtain a valid nonce for the AJAX action (e.g., by inspecting the plugin's frontend forms).
   • Identify a target media attachment ID (e.g., via wp-json/wp/v2/media).
   • Send a crafted POST request to /wp-admin/admin-ajax.php:

     curl -X POST 'http://target/wp-admin/admin-ajax.php' \
       --data 'action=acf_photo_gallery_edit_save&attachment_id=123&title=Hacked&caption=Malicious&meta[field]=value&_ajax_nonce=VALID_NONCE'
     

   • Verify the changes by viewing the attachment's metadata.

Blue Team (Defense & Detection)

• Monitor AJAX requests to admin-ajax.php with action=acf_photo_gallery_edit_save from low-privileged users.
• Audit media attachment changes for unexpected modifications to titles, captions, or custom fields.
• Implement a Web Application Firewall (WAF) rule to block requests to this action from non-admin users.
• Disable the plugin if no patch is available and the functionality is not critical.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=acf_photo_gallery_edit_save and attachment_id parameter.
• File: Modified post_title or post_excerpt in the wp_posts table for attachment posts.
• Log: WordPress debug log entries showing acf_photo_gallery_edit_save calls from unexpected user roles.
• Registry: Changes to wp_postmeta for attachments with keys like _acf_photo_gallery_*.

Detection Engineering

YARA Rule

rule CVE_2025_12081_ACF_Photo_Gallery_Field {
    meta:
        description = "Detects exploitation attempts for CVE-2025-12081 in WordPress ACF Photo Gallery Field plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12081"
    strings:
        $ajax_action = "acf_photo_gallery_edit_save"
        $attachment_id = "attachment_id"
        $title_param = "title"
        $caption_param = "caption"
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-12081 - ACF Photo Gallery Field Unauthorized Metadata Modification
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to admin-ajax.php with the vulnerable action from low-privileged users
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-ajax.php
        cs-uri-query|contains: action=acf_photo_gallery_edit_save
    condition: selection
falsepositives:
    - Legitimate admin users editing gallery items
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-12081 - ACF Photo Gallery Field Unauthorized Metadata Modification";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=acf_photo_gallery_edit_save"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable the ACF Photo Gallery Field plugin until a patch is released.
2. Workaround: Implement a custom capability check via a WordPress plugin or mu-plugin:

   add_action('wp_ajax_acf_photo_gallery_edit_save', 'custom_acf_photo_gallery_edit_save', 1);
   function custom_acf_photo_gallery_edit_save() {
       if (!current_user_can('edit_posts')) {
           wp_die('Unauthorized', 403);
       }
   }
   

3. Long-term: Monitor the plugin's repository for updates and apply the patch as soon as it becomes available.
4. Audit: Review all media attachments for unauthorized changes and revert if necessary.

Valters IT
Securing Digital Frontiers