CVE-2025-49394

Executive Summary

CVE-2025-49394 is a Missing Authorization vulnerability in the bPlugins Image Gallery block – Create and display photo gallery/photo album WordPress plugin, specifically in the 3d-image-gallery component. This flaw allows unauthenticated attackers to access functionality that should be protected by Access Control Lists (ACLs). The vulnerability affects all versions up to and including 1.0.7. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains due to the lack of authentication requirements.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are affected. There is no known compromise of the plugin’s supply chain, but the missing authorization could allow attackers to manipulate gallery data, potentially leading to further attacks on the WordPress instance.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The vulnerability is rated High due to the lack of authentication required to exploit it. While the impact on confidentiality, integrity, and availability is low individually, the ability to access restricted functionality without credentials poses a significant risk to the WordPress site’s security posture.

Deep Dive & Mechanics

The vulnerability stems from improper authorization checks in the 3d-image-gallery plugin. The plugin likely exposes AJAX actions or REST API endpoints that perform operations such as creating, editing, or deleting image galleries. These endpoints fail to verify that the requesting user has the necessary permissions (e.g., edit_posts or manage_options). As a result, any unauthenticated user can trigger these actions.

The affected component is the Image Gallery block which provides a Gutenberg block for displaying photo galleries. The missing authorization allows attackers to:

• Access gallery creation/modification functionality.
• Potentially inject malicious content into galleries.
• Bypass intended access controls for gallery management.

The vulnerability is classified under CWE-862: Missing Authorization, meaning the software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is hypothesized based on common WordPress plugin authorization flaws.

Vulnerable Code (Hypothetical):

add_action('wp_ajax_nopriv_create_gallery', 'create_gallery_callback');
function create_gallery_callback() {
    // No capability check
    $gallery_data = $_POST['gallery'];
    // Process and save gallery
    update_option('my_gallery', $gallery_data);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_create_gallery', 'create_gallery_callback');
add_action('wp_ajax_nopriv_create_gallery', 'create_gallery_callback');
function create_gallery_callback() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $gallery_data = $_POST['gallery'];
    // Process and save gallery
    update_option('my_gallery', $gallery_data);
    wp_die();
}

The patched version adds a capability check using current_user_can('edit_posts') to ensure only authenticated users with the appropriate role can create galleries.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with the vulnerable plugin (version <= 1.0.7) installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include /wp-admin/admin-ajax.php with actions like create_gallery, delete_gallery, or update_gallery.
2. Send a crafted POST request without authentication:

   curl -X POST http://target/wp-admin/admin-ajax.php \
     -d 'action=create_gallery&gallery[name]=malicious_gallery&gallery[content]=<script>alert(1)</script>'
   

3. Verify the gallery was created by accessing the WordPress admin or frontend.

Note: Since no public exploit exists, this is a theoretical approach. The exact action name may vary.

Blue Team

Detection:

• Monitor for unusual AJAX requests to /wp-admin/admin-ajax.php with actions related to gallery management from unauthenticated sources.
• Look for POST requests with parameters like action=create_gallery or action=delete_gallery without a valid nonce or authentication cookie.

Hunting:

• Search web server logs for requests to admin-ajax.php with action parameters containing gallery from IPs not associated with authenticated users.
• Use the following Sigma rule to detect potential exploitation.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=*gallery* from unauthenticated sources.
  • Unusual gallery creation or modification timestamps in WordPress logs.
• File System:
  • Unexpected entries in the wp_options table related to gallery data.
  • Modified or new gallery post types in the database.
• Logs:
  • Web server logs showing 200 responses to admin-ajax.php without prior authentication.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_49394_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-49394 in WordPress 3d-image-gallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49394"
    strings:
        $ajax_action = "action=create_gallery" nocase
        $ajax_action2 = "action=delete_gallery" nocase
        $ajax_action3 = "action=update_gallery" nocase
        $wp_ajax = "admin-ajax.php" nocase
    condition:
        any of ($ajax_action*) and $wp_ajax
}

Sigma Rule

title: CVE-2025-49394 WordPress 3d-image-gallery Missing Authorization
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated AJAX requests to gallery management actions in the vulnerable plugin.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-49394
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=create_gallery'
            - 'action=delete_gallery'
            - 'action=update_gallery'
    condition: selection
falsepositives:
    - Legitimate admin actions (requires authentication)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49394 WordPress 3d-image-gallery Missing Authorization Exploit"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=create_gallery"; http_client_body; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released. Navigate to WordPress Admin > Plugins and deactivate "Image Gallery block – Create and display photo gallery/photo album".
2. Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with gallery-related actions.
3. Monitor logs for any signs of exploitation as per the IOCs.

Long-term Fix:

• The vendor (bPlugins) must release a patched version that adds proper capability checks (e.g., current_user_can('edit_posts')) to all AJAX handlers.
• Users should update to the latest version once available.

Workaround:

• If the plugin is critical, restrict access to admin-ajax.php via .htaccess or server configuration to only allow authenticated requests:

  <Files "admin-ajax.php">
      Require valid-user
  </Files>
  

  Note: This may break legitimate AJAX functionality for non-authenticated users.

Valters IT
Securing Digital Frontiers