CVE-2025-27277: Add Linked Images To Gallery CSRF Flaw

CVE-2025-27277 Overview

CVE-2025-27277 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WordPress "Add Linked Images To Gallery" plugin developed by tiefpunkt. This vulnerability allows attackers to trick authenticated users into performing unintended actions on the WordPress site, potentially leading to stored Cross-Site Scripting (XSS) attacks. The flaw exists in all versions of the plugin up to and including version 1.4.

Critical Impact

Attackers can exploit this CSRF vulnerability to execute malicious actions on behalf of authenticated WordPress administrators, potentially chaining with stored XSS to compromise site integrity and visitor security.

Affected Products

• Add Linked Images To Gallery WordPress plugin version 1.4 and earlier
• WordPress installations using the add-linked-images-to-gallery-v01 plugin

Discovery Timeline

• 2025-02-24 - CVE-2025-27277 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-27277

Vulnerability Analysis

This CSRF vulnerability (CWE-352) exists in the Add Linked Images To Gallery WordPress plugin due to the absence of proper nonce verification on sensitive form submissions. When users interact with the plugin's administrative functions, the application fails to validate that requests originate from legitimate user sessions within the WordPress admin interface.

The vulnerability can be chained with stored XSS, allowing attackers to inject persistent malicious scripts through forged requests. This combination significantly amplifies the impact, as successful exploitation can lead to unauthorized content modifications, credential theft, and further compromise of the WordPress installation.

Root Cause

The root cause of CVE-2025-27277 is the missing or improper implementation of WordPress CSRF protection mechanisms. The plugin fails to implement WordPress nonce tokens (wp_nonce_field() and wp_verify_nonce()) on forms and AJAX handlers that process user input. Without these anti-CSRF tokens, the application cannot distinguish between legitimate user-initiated requests and malicious forged requests crafted by attackers.

Attack Vector

The attack requires user interaction and is conducted over the network. An attacker crafts a malicious HTML page or email containing a hidden form that submits a request to the vulnerable plugin endpoint. When an authenticated WordPress administrator visits the attacker-controlled page while logged into their WordPress site, the malicious form automatically submits, executing actions with the administrator's privileges.

The attack flow typically involves:

1. Attacker identifies a vulnerable form action in the plugin
2. Attacker creates a webpage with an auto-submitting form targeting the vulnerable endpoint
3. Attacker tricks an authenticated admin into visiting the malicious page
4. The browser sends the forged request with the admin's session cookies
5. The plugin processes the request, potentially storing malicious XSS payloads

Detection Methods for CVE-2025-27277

Indicators of Compromise

• Unexpected changes to gallery settings or linked image configurations in WordPress
• Suspicious JavaScript payloads appearing in plugin-managed content areas
• Unusual outbound network connections from visitor browsers when viewing galleries
• Unauthorized modifications to gallery entries without corresponding admin activity logs

Detection Strategies

• Review WordPress activity logs for administrative actions occurring without corresponding user interface sessions
• Monitor for HTTP POST requests to plugin endpoints without valid nonce parameters
• Implement Content Security Policy (CSP) headers to detect and block injected scripts
• Audit plugin database tables for unexpected or malicious content entries

Monitoring Recommendations

• Enable WordPress debug logging to capture plugin-related errors and unexpected behavior
• Deploy a Web Application Firewall (WAF) with CSRF detection rules
• Configure alerts for modifications to plugin settings outside normal administrative hours
• Regularly scan for XSS payloads in user-generated content managed by the plugin

How to Mitigate CVE-2025-27277

Immediate Actions Required

• Disable or deactivate the Add Linked Images To Gallery plugin immediately if not essential to site operations
• Review all gallery content and linked images for injected malicious scripts
• Audit WordPress user accounts for unauthorized access or permission changes
• Clear browser caches and instruct administrators to log out of all sessions

Patch Information

As of the last update, no official patch has been released for this vulnerability. The affected plugin versions include all releases through 1.4. Site administrators should monitor the Patchstack vulnerability database for updates regarding a security fix. Consider removing the plugin entirely if it is not actively maintained.

Workarounds

• Implement server-level CSRF protection using security plugins such as Wordfence or Sucuri
• Restrict administrative access to the plugin by limiting user roles and capabilities
• Use a Web Application Firewall to filter suspicious POST requests to plugin endpoints
• Educate administrators to avoid clicking untrusted links while authenticated to WordPress

# Configuration example - Disable the vulnerable plugin via WP-CLI
wp plugin deactivate add-linked-images-to-gallery-v01

# List all installed plugins to verify status
wp plugin list --status=active

# Optional: Remove the plugin entirely if no longer needed
wp plugin delete add-linked-images-to-gallery-v01