CVE-2025-22543: ST Gallery WP Authorization Bypass Vulnerability

CVE-2025-22543 Overview

CVE-2025-22543 is a Missing Authorization vulnerability [CWE-862] in the ST Gallery WP plugin by beautifultemplates for WordPress. The flaw affects all versions of st-gallery-wp up to and including 1.0.8. Authenticated users with low privileges can exploit incorrectly configured access control checks to modify plugin settings that should be restricted to administrators. The issue is remotely exploitable over the network and requires no user interaction.

Critical Impact
Authenticated attackers with low privileges can alter ST Gallery WP plugin settings due to missing capability checks, resulting in unauthorized configuration changes on affected WordPress sites.

Affected Products

beautifultemplates ST Gallery WP (st-gallery-wp) plugin for WordPress
All versions from n/a through 1.0.8
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-01-07 - CVE-2025-22543 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-22543

Vulnerability Analysis

The ST Gallery WP plugin exposes settings-modification functionality through endpoints that do not verify the caller's role or capability. WordPress plugins are expected to gate privileged actions with current_user_can() checks and nonce validation. This plugin omits or misconfigures those checks on settings-change actions.

As a result, any authenticated user, including low-privilege roles such as Subscriber, can invoke the affected actions and change plugin configuration. The vulnerability affects integrity and availability of the plugin's configuration, but does not directly disclose confidential data.

Root Cause

The root cause is a Missing Authorization defect classified under [CWE-862]. Handlers that process settings updates rely on authentication alone and fail to enforce role-based access control. Without a capability check, the WordPress permission model that separates administrators from lower roles is bypassed for the affected actions.

Attack Vector

Exploitation requires network access to the WordPress site and a valid low-privilege account. The attacker sends a crafted request to the plugin's settings handler and receives a successful response despite lacking administrative rights. No user interaction from a victim is required. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-22543

Indicators of Compromise

Unexpected changes to ST Gallery WP plugin settings recorded in the WordPress options table
Requests to plugin AJAX or admin-post handlers originating from non-administrator user sessions
New or modified gallery configurations that do not correspond to legitimate administrator activity

Detection Strategies

Review WordPress audit logs for settings-update actions performed by users below the Administrator role
Correlate HTTP POST requests to wp-admin/admin-ajax.php or admin-post.php with the acting user's capability level
Alert on modifications to plugin options associated with st-gallery-wp outside of scheduled change windows

Monitoring Recommendations

Enable a WordPress activity log plugin to capture user actions, role context, and option changes
Forward web server access logs to a central log platform and baseline expected administrative request patterns
Monitor authentication events for low-privilege accounts that suddenly issue plugin-management requests

How to Mitigate CVE-2025-22543

Immediate Actions Required

Deactivate the ST Gallery WP plugin until a patched version is confirmed available and installed
Audit all WordPress user accounts and remove or downgrade unused low-privilege accounts
Restrict registration on the WordPress site to reduce the pool of authenticated accounts that can reach the vulnerable endpoints

Patch Information

As of the last NVD update on 2026-06-17, all versions of ST Gallery WP up to and including 1.0.8 are listed as affected, with no fixed version identified in the reference data. Monitor the Patchstack Vulnerability Report and the plugin's WordPress.org listing for a vendor-supplied fix.

Workarounds

Uninstall the plugin if gallery functionality is not required for the site
Place the WordPress admin area behind an IP allowlist or web application firewall rule that blocks unauthorized POSTs to plugin handlers
Enforce strong authentication and multi-factor authentication for every WordPress account to reduce the risk of low-privilege account compromise

bash

# Configuration example: block requests to the plugin's admin-ajax actions from non-admin sessions at the WAF
# Example ModSecurity rule (illustrative)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1002543,msg:'Block ST Gallery WP settings change from non-admin'"
  SecRule ARGS:action "@rx ^st_gallery_wp_" \
    "chain"
    SecRule REQUEST_COOKIES:/wordpress_logged_in_/ "@rx .+" \
      "chain"
      SecRule &REQUEST_HEADERS:X-Admin-Session "@eq 0"