PT-2026-20602 · WordPress · Wp Audio Gallery

Published 2026-02-19 · Updated 2026-02-19 · CVE-2025-13603

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP AUDIO GALLERY versions prior to 2.1

Description The WP AUDIO GALLERY plugin for WordPress is susceptible to an unauthorized arbitrary file read issue in versions up to 2.0. This is caused by inadequate capability checks and a lack of nonce verification within the wpag htaccess callback function. Authenticated attackers with subscriber-level access or higher can overwrite the site's .htaccess file with arbitrary content, potentially leading to arbitrary file read on the server, depending on the server configuration.

Recommendations Update WP AUDIO GALLERY to version 2.1 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13603

Affected Products

Wp Audio Gallery

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13603 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/lib/util-functions.php#L133 · Note
• https://twitter.com/CveTodo/status/2024531204431598074 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L647 · Note
• https://twitter.com/CVEnew/status/2024501282514633049 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/852959d1-f8e0-4c1f-8a5c-5923bedc4889?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L162 · Note