The ACF Photo Gallery Field plugin for WordPress contains a missing capability check in the acf_photo_gallery_edit_save function. Because the check is omitted, any authenticated user with subscriber role or higher can change the title, caption, and custom metadata of any media attachment. This flaw does not provide remote code execution or system compromise but allows attackers to subvert the integrity of media content, potentially defacing pages or carrying out subtle data manipulation. The weakness represents a classic authorization bypass (CWE‑862).

The vulnerability affects the navzme ACF Photo Gallery Field WordPress plugin in all versions up to and including 3.0. No specific sub‑versions are listed, so any installation of the plugin with a version number 3.0 or lower is at risk.

The CVSS score of 4.3 classifies the weakness as low severity, while the EPSS score of less than 1% indicates a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers need only be authenticated with a subscriber role or higher to exploit the issue, so the attack vector is local authentication rather than remote. The impact is confined to data integrity of media attachments, and no escalation to system compromise is possible based on the available information.