What is the CVSS score of CVE-2025-6726?

CVE-2025-6726 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-6726

MEDIUM

Missing Authorization (CWE-862)

2025-07-18 security@wordfence.com

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Jul 18, 2025 - 06:15 nvd

MEDIUM 4.3

DescriptionCVE.org

The Block Editor Gallery Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the classic_gallery_slider_options() function in all versions up to, and including, 1.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited post meta for arbitrary posts.

AnalysisAI

Block Editor Gallery Slider plugin for WordPress up to version 1.1.1 allows authenticated Subscriber-level attackers to modify post metadata for arbitrary posts due to a missing capability check in the classic_gallery_slider_options() function. The vulnerability has a CVSS score of 4.3 and requires only low-privileged authenticated access with no user interaction, but carries limited impact (data integrity only, no confidentiality or availability breach). No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization / Improper Authorization), where the WordPress plugin fails to validate user capabilities before processing an AJAX or REST endpoint that modifies post meta. WordPress uses a capability system where Subscriber is the lowest authenticated role; a missing check on the classic_gallery_slider_options() function allows this function to execute without verifying whether the calling user should have permission to edit posts. The underlying issue is the absence of a capability check such as current_user_can('edit_post', $post_id) before allowing post metadata updates. This is common in WordPress plugins that interact with post metadata without proper authorization gates.

Affected ProductsAI

Block Editor Gallery Slider plugin for WordPress in all versions up to and including 1.1.1 is affected. The plugin is available on the official WordPress plugin repository (wordpress.org/plugins/block-editor-gallery-slider/). No specific CPE string is provided in the input data, but the vulnerability affects WordPress installations with this plugin active. The advisory references the WordPress plugin repository changeset and a Wordfence threat intelligence page for additional details.

RemediationAI

Update the Block Editor Gallery Slider plugin to a version patched after 1.1.1. The plugin developer has released a fix; site administrators should navigate to Plugins > Installed Plugins in the WordPress dashboard and update to the latest version when available. If an immediate patched release is not yet available, temporarily disable the Block Editor Gallery Slider plugin until a security update is released. Wordfence security advisories (https://www.wordfence.com/threat-intel/vulnerabilities/id/770b0401-4d05-476e-a2b1-e9e9c920f5fa) and the official WordPress plugin repository should be monitored for version updates and detailed remediation guidance.