Path Traversal Vulnerability in Image Gallery Plugin for WordPress

CVE-2025-13891

What is CVE-2025-13891?

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress exposes a path traversal vulnerability through its modula_list_folders AJAX endpoint. This issue arises from insufficient path validation and base directory restrictions, allowing authenticated users with Author permissions or higher to potentially access unauthorized directories on the server. The failure to confine user-supplied directory paths to designated safe directories poses a significant security risk, enabling attackers to enumerate arbitrary directories.

References