Unauthorized Arbitrary File Read Vulnerability in WP AUDIO GALLERY Plugin

CVE-2025-13603

What is CVE-2025-13603?

The WP AUDIO GALLERY plugin for WordPress contains a vulnerability that allows authenticated users with subscriber-level access or higher to exploit inadequate capability checks. The flaw resides in the 'wpag_htaccess_callback' function, where nonce verification is missing. This oversight can be exploited to overwrite the .htaccess file with arbitrary content, potentially leading to unauthorized file read on the server under specific conditions. As such, it poses significant risks to the integrity and security of affected WordPress sites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References