CVE-2026-25345: SimpLy Gallery WordPress plugin up to 3.3.2 - Arbitrary Code Execution

Overview

The record describes an improper validation of a specified quantity in input in the SimpLy Gallery WordPress plugin (slug simply-gallery-block) by GalleryCreator, mapped to CWE-1284. The description says it allows access to functionality not properly constrained by access control lists, while the Patchstack entry titles it arbitrary code execution. Affected versions are listed as up to and including 3.3.2.

Impact

• The CNA rates the issue critical with a base score of 9.9 and a vector indicating network reachability, low attack complexity, low privileges required, no user interaction, changed scope, and high confidentiality, integrity and availability impact.
• The SSVC data in the record rates technical impact as total.
• Whether the impact includes code execution on the server is stated only in the title; the record does not describe the mechanism.

Affected products and versions

• GalleryCreator SimpLy Gallery (simply-gallery-block), versions up to and including 3.3.2.
• The record lists no fixed version. Whether a patched release exists is unknown from the sources consulted.

Exploitation status

• The record shows this CVE is not listed in the CISA KEV catalogue.
• SSVC exploitation is recorded as none and automatable as no.
• No confirmed exploitation appears in the sources consulted.
• The EPSS probability is recorded as 0.00464 with a percentile of 0.39256.

Remediation and mitigation

• Identify whether the SimpLy Gallery plugin is installed on WordPress sites and which version is running.
• Treat installations at version 3.3.2 and earlier as potentially vulnerable and check the vendor or the Patchstack entry for an updated release.
• If no fix is available, consider disabling or removing the plugin on exposed sites, limiting access to administrative functions, and reviewing user roles and privileges.
• Follow the vendor and Patchstack for updates, as the record may be revised.

Detection guidance

• Review web server and application logs for unexpected requests to the plugin and for unusual activity from low-privilege accounts.
• Check WordPress installations for unexpected administrative users, unfamiliar files, or modified plugin files.
• Where feasible, apply file integrity monitoring to the plugin directory.

Limitations of the available information

• The record contains no technical detail on the flaw, affected components, or a fixed version.
• The title refers to arbitrary code execution while the description refers to access control constraints; the record does not explain how these relate.
• The description gives the lower bound as n/a, so older releases are not characterized.
• The EPSS date in the record does not clearly align with the publication date; values are reported as recorded.

Frequently asked questions

Which versions of SimpLy Gallery are affected?

The record lists versions up to and including 3.3.2. It does not list a fixed version, so whether a patched release exists is unknown from the sources consulted.

Is this vulnerability being actively exploited?

The record does not list this CVE in the CISA KEV catalogue, and no confirmed exploitation appears in the sources consulted. SSVC data records exploitation as none.

What should site owners do now?

Identify installations of the plugin, check the vendor or Patchstack for an update, and if none exists, consider disabling the plugin on exposed sites while reviewing user privileges and logs.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.