The vulnerability in the totalsoft Portfolio Gallery plugin allows an attacker to bypass authorization controls and access features or data that should be restricted. CVE‑2025‑62098 describes a missing or incorrectly configured access control, enabling exploitation by users who should not have such privileges. This flaw can result in unauthorized viewing or manipulation of gallery content, potentially leading to data leakage or tampering.

Affected deployments are those running totalsoft Portfolio Gallery plugin version 1.4.8 or earlier, including any installations that have not upgraded from older versions. The issue applies broadly all affected releases, regardless of site configuration, as the access control is insufficient by default.

Given a CVSS score of 5.4 and an EPSS score below 1%, the technical severity is moderate while the likelihood of exploitation is low. The flaw is not listed in CISA's Known Exploited Vulnerabilities catalog. Attackers would likely exploit the web interface that serves the gallery, sending crafted requests to gain unauthorized access. No additional prerequisites are mentioned, so the risk remains largely dependent on the presence of the vulnerable plugin and lack of supplemental controls.