CVE-2025-13645: The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file'…

PriorityP350high7.2CVSS 3.1

AVNACLPRHUINSUCHIHAH

EPSS

0.92%

55.6th percentile

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Affected

2 ranges

Vendor	Product	Version range	Fixed in
wpchill	image_gallery_photo_grid_video_gallery	2.13.1 – 2.13.2	—
wpchill	modula_image_gallery	>= 2.13.1 < 2.13.3	2.13.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.