Modula Image Gallery Plugin Faces High Severity Arbitrary File Deletion Vulnerability
A significant security flaw has been identified in the Modula Image Gallery plugin for WordPress, impacting versions 2.13.1 through 2.13.2. This vulnerability, tracked as CVE-2025-13645, allows attackers with as little as Author-level access to delete important files on your website. Such an action could lead to a complete takeover of your site by enabling remote code execution.
CVE Details
- Product: Modula Image Gallery plugin for WordPress
- CVE ID: CVE-2025-13645
- Published: December 3, 2025
- Severity: High (CVSS Score: 7.2)
- Status: Analyzed
Affected Products
The vulnerability primarily affects the Modula Image Gallery plugin for WordPress, specifically versions 2.13.1 to 2.13.2. Users running these versions are at risk and should take immediate action.
Current Status
The vulnerability has been officially “Analyzed,” meaning its details have been confirmed and documented. Developers and administrators should be aware of this risk and prioritize mitigation.
Severity Level
This vulnerability is rated as High Severity with a CVSS score of 7.2. This rating indicates that the flaw presents a serious risk. An attacker exploiting this vulnerability could delete critical website files, such as wp-config.php, which contains database login details. Deleting or manipulating such files can pave the way for remote code execution, giving the attacker full control over your WordPress site. This could lead to data theft, website defacement, or the installation of malicious software.
Possible Solutions
The core of this vulnerability lies in “insufficient file path validation” within the ajax_unzip_file function. This means the plugin wasn’t properly checking if the files being deleted were legitimate or if the operation was allowed. While the initial GitHub commit link provided did not resolve, the existence of multiple WordPress Trac changeset links strongly suggests that the developers have addressed the issue.
It is crucial for all users running affected versions (2.13.1 and 2.13.2) to update their Modula Image Gallery plugin to a patched version immediately. Although a specific patched version isn’t explicitly stated in the immediately accessible information, it is safe to assume that any version released after 2.13.2 will contain the necessary fix. Always ensure your WordPress plugins are kept up-to-date to protect against known vulnerabilities. Regularly backing up your website is also a vital defense in case of a successful attack.
For more general security advice, you might find our articles on Understanding WordPress Security and Plugin Security Best Practices helpful.
References
https://github.com/WPChill/modula-lite/commit/90c8eb982f71b31584d9be9359e3b594e03927d7
https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.13.2/includes/admin/class-modula-gallery-upload.php#L1025
https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.13.2/includes/admin/class-modula-gallery-upload.php#L1119
https://plugins.trac.wordpress.org/changeset/3395701/modula-best-grid-gallery#file5
https://plugins.trac.wordpress.org/changeset/3407949/modula-best-grid-gallery
https://www.wordfence.com/threat-intel/vulnerabilities/id/080683bb-713f-4aa8-b635-90c96f358bec?source=cve
