CVE-2025-13645
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Risk Assessment
An attacker can delete critical files, causing site failure or remote code execution, leading to full server compromise.
Recommendation
Update the Modula Image Gallery plugin to a version later than 2.13.2 or disable it if no update is available.
Other vulnerabilities in Modula Image Gallery
See all- CVE-2026-107659High
The Modula Image Gallery plugin for WordPress (versions up to and including 3.0.11) is vulnerable to sensitive information exposure via the 'id' parameter in /wp-json/wp/v2/modula-gallery/{id}. An unauthenticated attacker can extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field.
- CVE-2026-105876Medium
The Modula Image Gallery plugin for WordPress contains a missing authorization vulnerability that allows retrieving embedded sensitive data. The issue affects versions up to and including 3.0.11.
- CVE-2026-65475Medium
The Modula Image Gallery plugin versions 2.14.25 through 2.14.30 are vulnerable to stored XSS attacks. An attacker can inject a malicious script that executes in other users' browsers.
- CVE-2026-42688Medium
There is a Subscriber Cross Site Scripting (XSS) vulnerability in Modula Image Gallery versions up to 2.14.23.
- CVE-2026-39481High
Modula Image Gallery versions up to 2.14.18 are vulnerable to PHP Object Injection, which may lead to unauthorized access to the system.
- CVE-2025-13646High
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files with race condition on the affected site's server which may make remote code execution possible.
Original NVD description (English source)
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS