CVE-2025-13891: 
WordPress vulnerability analysis and mitigation

CVE-2025-13891 is a path traversal vulnerability in the Image Gallery – Photo Grid & Video Gallery WordPress plugin (also known as Modula Best Grid Gallery), developed by WPChill. It affects all versions up to and including 2.13.3, and was published on December 12, 2025. The flaw allows authenticated attackers with Author-level access or above to enumerate arbitrary directories on the server. It carries a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, Red Hat CVE).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22). The vulnerable modula_list_folders AJAX endpoint checks that the requesting user holds upload_files and edit_posts capabilities (Author-level or above), but it does not validate that the user-supplied directory path is confined to a safe base directory. This allows an attacker to supply path traversal sequences (e.g., ../) to walk outside the intended upload directory and enumerate arbitrary filesystem directories on the server. Vulnerable code is present in includes/admin/class-modula-gallery-upload.php at lines 160, 230, and 411 of the 2.12.26 tag (Wordfence, CleanTalk Research).

Successful exploitation allows an authenticated attacker to enumerate arbitrary directories on the web server's filesystem, exposing sensitive directory structures, configuration file locations, and potentially the presence of other applications or credentials stored in accessible paths. The confidentiality impact is rated High, while integrity and availability are unaffected. Although this vulnerability does not directly enable file read or code execution, the directory enumeration it provides can serve as a reconnaissance step for chaining with other vulnerabilities to achieve deeper compromise (Wordfence, Red Hat CVE).

No public exploit code or in-the-wild exploitation has been reported for CVE-2025-13891 as of the available data. The EPSS score is approximately 0.043%, indicating a low probability of exploitation in the near term. The vulnerability requires at minimum Author-level authentication, which limits the attack surface compared to unauthenticated flaws. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has published a detection (ID: 530811) for this vulnerability (Wordfence, Qualys).

1. Reconnaissance: Identify WordPress sites running the Modula Best Grid Gallery plugin (versions ≤ 2.13.3) using tools like WPScan or by inspecting plugin directories exposed via the target site.
2. Obtain Author-level credentials: Acquire or create an account with at minimum Author-level access (requiring upload_files and edit_posts capabilities) on the target WordPress site.
3. Authenticate: Log in to the WordPress site and obtain a valid authentication nonce for AJAX requests.
4. Craft malicious AJAX request: Send an authenticated POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with action=modula_list_folders and a user-supplied directory path containing path traversal sequences (e.g., path=../../etc/).
5. Enumerate directories: Analyze the server's response to identify directory listings outside the intended upload directory, mapping sensitive filesystem paths for further attack planning (Wordfence, CleanTalk Research).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=modula_list_folders and directory path parameters containing ../ sequences or absolute paths outside the WordPress upload directory.
• Logs: WordPress or web server access logs showing repeated AJAX calls to admin-ajax.php with traversal patterns in POST body parameters from Author-level user accounts.
• Logs: Unexpected directory paths (e.g., /etc/, /var/, /home/) appearing in application debug or error logs related to the Modula plugin's file listing functionality.

WPChill released version 2.13.4 of the Image Gallery – Photo Grid & Video Gallery plugin, which addresses this vulnerability by adding proper path validation and base directory restrictions to the modula_list_folders AJAX endpoint. Site administrators should update the plugin to version 2.13.4 or later immediately. As a temporary workaround where updating is not immediately possible, restricting Author-level account creation and auditing existing Author accounts can reduce exposure (Wordfence, WordPress Changeset).

Wordfence included CVE-2025-13891 in its weekly WordPress vulnerability report for December 8–14, 2025, and CleanTalk Research published a dedicated write-up on the vulnerability. Qualys added a detection for this CVE (ID: 530811) in its January 2026 application security detections update. No significant broader media coverage or notable researcher commentary beyond these standard disclosure channels has been identified (Wordfence Weekly Report, Qualys).