PT-2025-48789 · WordPress · Modula Image Gallery

Ismailshadow · Published 2025-12-03 · Updated 2025-12-08 · CVE-2025-13645

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Modula Image Gallery plugin for WordPress versions 2.13.1 through 2.13.2

Description The Modula Image Gallery plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the ajax unzip file function. Authenticated attackers possessing Author-level access or higher can exploit this to delete arbitrary files on the server. Deletion of specific files, such as wp-config.php, could potentially lead to remote code execution.

Recommendations Update the Modula Image Gallery plugin to a newer, fixed version. As a temporary workaround, restrict access for users with Author-level permissions or higher. Consider disabling the ajax unzip file function until a patch is available.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-13645

Affected Products

Modula Image Gallery

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-13645 · Security Note
• https://plugins.trac.wordpress.org/changeset/3395701/modula-best-grid-gallery#file5 · Patch
• https://plugins.trac.wordpress.org/changeset/3407949/modula-best-grid-gallery · Patch
• https://osv.dev/vulnerability/CVE-2025-13645 · Vendor Advisory
• https://github.com/WPChill/modula-lite/commit/90c8eb982f71b31584d9be9359e3b594e03927d7 · Note
• https://t.me/CVEtracker/38730 · Telegram Post
• https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.13.2/includes/admin/class-modula-gallery-upload.php#L1119 · Note
• https://twitter.com/RedPacketSec/status/1996089085228720594 · Twitter Post
• https://twitter.com/CVEnew/status/1996064379779833977 · Twitter Post
• https://twitter.com/SecAideInfo/status/1996886478585319717 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/080683bb-713f-4aa8-b635-90c96f358bec?source=cve · Note
• https://twitter.com/cracbot/status/1997984540619678033 · Twitter Post
• https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.13.2/includes/admin/class-modula-gallery-upload.php#L1025 · Note
• https://twitter.com/VulmonFeeds/status/1996083200393621817 · Twitter Post
• https://t.me/cveNotify/144578 · Telegram Post