Overview
A critical security vulnerability has been identified in the Modula Image Gallery plugin for WordPress, tracked as CVE-2025-13646. This vulnerability allows authenticated attackers with Author-level access or higher to upload arbitrary files to the affected WordPress server. Due to missing file type validation in a specific function, this could potentially lead to remote code execution (RCE) through race conditions, posing a significant risk to websites using the plugin.
Technical Details
The vulnerability resides in the ajax_unzip_file function within the Modula Image Gallery plugin, specifically in versions 2.13.1 and 2.13.2. The lack of proper file type validation during the upload process allows attackers to bypass intended security measures. By exploiting this flaw, malicious actors can upload files containing executable code, potentially gaining control of the server. The vulnerable code is located in this file.
CVSS Analysis
- CVE ID: CVE-2025-13646
- Severity: HIGH
- CVSS Score: 7.5
A CVSS score of 7.5 indicates a high-severity vulnerability. Exploitation is relatively easy, requires authentication (Author-level or higher), and could have significant impact on the availability, integrity, and confidentiality of the affected system.
Possible Impact
The successful exploitation of this vulnerability can have severe consequences, including:
- Remote Code Execution (RCE): Attackers can execute arbitrary code on the server, potentially gaining full control of the website.
- Website Defacement: Attackers can modify the website’s content, damaging its reputation.
- Data Theft: Attackers can steal sensitive data, such as user credentials, financial information, and confidential business data.
- Malware Distribution: Attackers can use the compromised website to distribute malware to visitors.
Mitigation or Patch Steps
The recommended course of action is to immediately update the Modula Image Gallery plugin to the latest available version. The vulnerability has been patched in subsequent versions. If an update is not immediately possible, consider temporarily disabling the plugin until the update can be applied. The fix can be found in these commits:
Commit 1,
Commit 2,
Commit 3.
