PT-2025-50899 · WordPress · Image Gallery – Photo Grid & Video Gallery
Dmitry Ignatyev
·
Published
2025-12-12
·
Updated
2025-12-12
·
CVE-2025-13891
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Image Gallery – Photo Grid & Video Gallery plugin for WordPress versions through 2.13.3
Description
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is susceptible to a path traversal issue. This is due to insufficient path validation and base directory restrictions in the
modula list folders API endpoint. Although the endpoint checks user permissions (Author+ with upload files and edit posts capabilities), it does not confirm that user-provided directory paths are within authorized directories. This allows authenticated attackers with Author-level access or higher to list arbitrary directories on the server using the modula list folders endpoint.Recommendations
Update the Image Gallery – Photo Grid & Video Gallery plugin to a version beyond 2.13.3.
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Image Gallery – Photo Grid & Video Gallery