Arbitrary File Upload Vulnerability in Modula Image Gallery for WordPress
CVE-2025-13646

7.5HIGH

Key Information:

Vendor

WordPress
Status
Image Gallery – Photo Grid & Video Gallery
Vendor
CVE Published:
3 December 2025

What is CVE-2025-13646?

The Modula Image Gallery plugin for WordPress contains a vulnerability that allows authenticated users with Author-level access and above to upload arbitrary files. This issue arises from inadequate file type validation in the 'ajax_unzip_file' function, affecting versions 2.13.1 to 2.13.2. Exploiting this vulnerability could lead to the execution of malicious code on the affected server, creating significant risks for site security.

Affected Version(s)

Image Gallery – Photo Grid & Video Gallery 2.13.1 <= 2.13.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://github.com/WPChill/modula-lite/blob/master/includ...
https://plugins.trac.wordpress.org/changeset/3395701/modu...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yevhenii Butenko
JSON
.