Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

WordPress Modula Image Gallery plugin: Unauthenticated File Deletion

CVE-2025-13645 · published 11 months ago
Summary

A security issue in the Modula Image Gallery plugin for WordPress allows attackers with Author-level access to delete any files on your server. This could let them gain control over your site and install malware. Update the plugin to a fixed version to avoid this risk.

What to do
  • Update wpchill modula_image_gallery to version 2.13.3 or later.
Affected software
VendorProductAffected versions
wpchill modula_image_gallery >= 2.13.1, < 2.13.3
cpe:2.3:a:wpchill:modula_image_gallery:*:*:*:*:*:wordpress:*:*
Original advisory text
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This ...
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.2 High
Exploitation
1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published3 Dec 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-13645 · NVD
Track software like this
Free during beta