CVE-2025-13645
Published: 03 December 2025
Summary
CVE-2025-13645 is a high-severity Path Traversal (CWE-22) vulnerability in Wpchill Modula Image Gallery. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 21.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Modula Image Gallery plugin for WordPress, versions 2.13.1 through 2.13.2, is affected by an arbitrary file deletion vulnerability (CWE-22) stemming from insufficient file path validation in the ajax_unzip_file function. The flaw resides in the plugin's administrative upload handling code and carries a CVSS 3.1 score of 7.2.
Authenticated attackers holding Author-level access or higher can invoke the vulnerable AJAX endpoint to supply crafted paths and delete arbitrary files on the underlying server. Successful exploitation can remove critical files such as wp-config.php, resulting in remote code execution or full site compromise.
Public references include a GitHub commit that addresses the path validation issue along with WordPress Trac changesets 3395701 and 3407949 that update the affected class-modula-gallery-upload.php file, indicating an official patch is available in subsequent plugin releases. The associated EPSS score remains low, with a current value of 0.0115 and a peak of 0.0139.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-200725
Vulnerability details
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above,…
more
to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.