Path Traversal Vulnerability in Image Gallery Plugin for WordPress

CVE-2025-13891

What is CVE-2025-13891?

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress exposes a path traversal vulnerability through its modula_list_folders AJAX endpoint. This issue arises from insufficient path validation and base directory restrictions, allowing authenticated users with Author permissions or higher to potentially access unauthorized directories on the server. The failure to confine user-supplied directory paths to designated safe directories poses a significant security risk, enabling attackers to enumerate arbitrary directories.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References