PT-2025-48790 · WordPress · Modula Image Gallery

Yevhenii Butenko · Published 2025-12-03 · Updated 2025-12-08 · CVE-2025-13646

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Modula Image Gallery plugin for WordPress versions 2.13.1 through 2.13.2

Description The Modula Image Gallery plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation. This issue is present in the ajax unzip file function. Authenticated attackers with Author-level access or higher can upload arbitrary files, potentially leading to remote code execution due to a race condition on the server. The ajax unzip file function is the component affected by this issue.

Recommendations Update the Modula Image Gallery plugin to a version newer than 2.13.2.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-13646

Affected Products

Modula Image Gallery

References · 12

• https://osv.dev/vulnerability/CVE-2025-13646 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3395701/modula-best-grid-gallery#file5 · Patch
• https://plugins.trac.wordpress.org/changeset/3407949/modula-best-grid-gallery · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-13646 · Security Note
• https://github.com/WPChill/modula-lite/blob/master/includes/admin/class-modula-gallery-upload.php#L1103 · Note
• https://github.com/WPChill/modula-lite/commit/90c8eb982f71b31584d9be9359e3b594e03927d7 · Note
• https://twitter.com/cracbot/status/1997984542293151850 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/59ee0ca2-846d-4ae8-ad19-7c3826861aeb?source=cve · Note
• https://t.me/CVEtracker/38731 · Telegram Post
• https://twitter.com/RedPacketSec/status/1996089086738608146 · Twitter Post
• https://t.me/cveNotify/144579 · Telegram Post
• https://twitter.com/CVEnew/status/1996064377724678574 · Twitter Post