PT-2025-49135 · WordPress · Inpost Gallery

Moose Love · CVE-2025-13543 · Published 2025-12-04 · Updated 2026-03-08

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PostGallery plugin for WordPress versions through 1.12.5

Description The PostGallery plugin for WordPress is susceptible to arbitrary file uploads because of inadequate file type validation within the 'PostGalleryUploader' class functions. This allows authenticated attackers possessing subscriber-level permissions or higher to upload arbitrary files to the server of the affected site, potentially enabling remote code execution.

Recommendations Update the PostGallery plugin to a version later than 1.12.5.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-13543

Affected Products

Inpost Gallery

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13543 · Security Note
• https://twitter.com/RedPacketSec/status/1996739421559771488 · Twitter Post
• https://plugins.trac.wordpress.org/browser/postgallery/tags/1.12.5/admin/PostGalleryUploader.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/13348eb5-5001-4ec4-bc6a-44795bbed203?source=cve · Note
• https://twitter.com/akaclandestine/status/2012689852156756145 · Twitter Post
• https://twitter.com/sudo_wp/status/2030466050072985728 · Twitter Post
• https://twitter.com/CVEnew/status/1996682390408728626 · Twitter Post
• https://twitter.com/CveFindCom/status/1996695865981911097 · Twitter Post