CVE-2025-13645: 
WordPress vulnerability analysis and mitigation

CVE-2025-13645 is an arbitrary file deletion vulnerability in the Modula Image Gallery plugin for WordPress, caused by insufficient file path validation in the ajax_unzip_file function. It affects plugin versions 2.13.1 through 2.13.2, and was published on December 3, 2025, with a patch released in version 2.13.3. The vulnerability is classified as CWE-22 (Path Traversal) and carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat CVE).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22 / Path Traversal) within the ajax_unzip_file function in includes/admin/class-modula-gallery-upload.php. The function fails to adequately validate or sanitize file paths supplied by the user, allowing an attacker to craft a request that references files outside the intended upload directory. Exploitation requires an authenticated session with at least Author-level WordPress privileges, and no user interaction beyond the attacker's own actions is needed. The vulnerable code paths are visible in the plugin source at lines 1025 and 1119 of the affected file (Wordfence, WordPress Trac).

An authenticated attacker with Author-level access or higher can delete arbitrary files on the web server's filesystem. The most critical scenario involves deleting wp-config.php, which triggers WordPress to enter its setup/installation mode, enabling an attacker to reconfigure the database connection and achieve remote code execution. This can result in full compromise of the WordPress site, including confidentiality loss (access to sensitive data), integrity loss (site defacement or malicious code injection), and availability loss (site disruption) (Wordfence, Sucuri Blog).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The vulnerability requires authenticated access at the Author level or above, which limits the attack surface compared to unauthenticated vulnerabilities. The EPSS score is approximately 0.0085 (low probability of exploitation in the near term). The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running Modula Image Gallery plugin versions 2.13.1 or 2.13.2 (e.g., via WPScan or by checking the plugin's readme.txt at wp-content/plugins/modula-best-grid-gallery/readme.txt).
2. Obtain Author-level credentials: Acquire valid WordPress credentials with at least Author-level privileges through phishing, credential stuffing, or other means.
3. Authenticate: Log in to the WordPress admin panel (/wp-admin/) using the obtained credentials.
4. Craft malicious request: Send an authenticated AJAX request to the ajax_unzip_file function with a path-traversal payload in the file path parameter (e.g., using ../../ sequences) targeting a critical file such as wp-config.php.
5. Trigger file deletion: The insufficient path validation allows the traversal, and the server deletes the targeted file outside the intended upload directory.
6. Achieve RCE (optional): If wp-config.php is deleted, navigate to the WordPress site root to trigger the installation wizard, then reconfigure the database to point to an attacker-controlled instance, enabling full site takeover and remote code execution (Wordfence).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php with action=modula_unzip_file (or similar) containing path traversal sequences (../, %2e%2e%2f, etc.) in file path parameters.
• File System: Unexpected deletion of critical WordPress files such as wp-config.php, .htaccess, or core WordPress files; timestamps of file deletions correlating with suspicious AJAX requests.
• Logs: WordPress debug logs or server error logs showing file operation errors or unexpected file-not-found conditions for core files.
• Network: Unusual POST requests to wp-admin/admin-ajax.php from Author-level accounts at odd hours or from unexpected IP addresses.
• Process: WordPress entering installation/setup mode (site redirecting to wp-admin/setup-config.php) without administrator action, indicating wp-config.php may have been deleted.

Update the Modula Image Gallery plugin to version 2.13.3 or later, which contains the patch addressing the insufficient path validation (WordPress Trac Changeset, GitHub Commit). As interim measures, restrict WordPress user roles to minimize the number of accounts with Author-level access or above, and ensure regular, off-site backups of the WordPress filesystem (especially wp-config.php) are maintained. Monitoring file integrity with a tool such as Wordfence or a server-side file integrity monitor can help detect unauthorized deletions promptly.

The vulnerability was discovered and disclosed by Wordfence, which published the advisory on December 3, 2025. Sucuri included it in their December 2025 vulnerability patch roundup, noting the risk of RCE via wp-config.php deletion (Sucuri Blog). RedPacketSecurity shared the advisory on social media (Mastodon and Twitter/X), contributing to broader community awareness. No significant controversy or unusual community debate has been noted around this CVE.