CVE-2025-13603
Published: 19 February 2026
Summary
CVE-2025-13603 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-13603 is a vulnerability in the WP Audio Gallery plugin for WordPress, affecting all versions up to and including 2.0. It enables unauthorized arbitrary file reads due to insufficient capability checks and missing nonce verification in the wpag_htaccess_callback function. The issue is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-862 (Missing Authorization).
Authenticated attackers with subscriber-level access or higher can exploit this flaw over the network with low complexity and no user interaction required. By calling the vulnerable function, they can overwrite the site's .htaccess file with arbitrary content, potentially enabling arbitrary file reads on the server under certain configurations.
Advisories and references, including Wordfence threat intelligence and WordPress plugin trac source code, detail the vulnerability at specific lines such as util-functions.php#L133, wp-audio-gallery.php#L162, and wp-audio-gallery.php#L647. These sources confirm the lack of protections but do not specify patch availability or mitigation steps beyond identifying the affected code.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207917
Vulnerability details
The WP AUDIO GALLERY plugin for WordPress is vulnerable to Unauthorized Arbitrary File Read in all versions up to, and including, 2.0. This is due to insufficient capability checks and lack of nonce verification on the "wpag_htaccess_callback" function This makes…
more
it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's .htaccess file with arbitrary content, which can lead to arbitrary file read on the server under certain configurations.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct exploitation of public-facing WordPress plugin via missing authorization to overwrite .htaccess and enable file reads.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the insufficient capability checks in the wpag_htaccess_callback function by enforcing approved authorizations for accessing and modifying system resources like .htaccess files.
Mitigates exploitation by subscriber-level users through enforcing least privilege, preventing low-privileged authenticated attackers from overwriting critical files.
Restricts access to configuration changes such as .htaccess file modifications, countering the unauthorized overwrite enabled by missing nonce verification and capability checks.