CVE-2025-13645 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' functio…
High CVSS: 7.2

CVE-2025-13645

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Vendor
Wpchill
Product
Modula Image Gallery
CWE
CWE-22
Yayın Tarihi
2025-12-03 03:15:59
Güncelleme
2025-12-15 15:39:46
Source Identifier
security@wordfence.com
KEV Date Added
-

Kategoriler

CWE-22 Modula Image Gallery HIGH Wpchill 2025

Referanslar

https://github.com/WPChill/modula-lite/commit/90c8eb982f71b31584d9be9359e3b594e03927d7 https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.13.2/includes/admin/class-modula-gallery-upload.php#L1025 https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.13.2/includes/admin/class-modula-gallery-upload.php#L1119 https://plugins.trac.wordpress.org/changeset/3395701/modula-best-grid-gallery#file5 https://plugins.trac.wordpress.org/changeset/3407949/modula-best-grid-gallery https://www.wordfence.com/threat-intel/vulnerabilities/id/080683bb-713f-4aa8-b635-90c96f358bec?source=cve