CVE-2025-13891mediumCWE-22

CVE-2025-13891: medium-severity vulnerability in wpchill Modula Image Gallery – Photo Grid &…

Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing

Published · Updated

Follow this CVE+ Monitor Modula Image Gallery – Photo Grid & Video Gallery

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.4%
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint that lacks proper path validation and base directory restrictions. While the endpoint verifies user capabilities (Author+ with upload_files and edit_posts permissions), it fails to validate that user-supplied directory paths reside within safe directories. This makes it possible for authenticated attackers, with Author-level access and above, to enumerate arbitrary directories on the server via the modula_list_folders endpoint.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
wpchill · Modula Image Gallery – Photo Grid & Video Gallery
Related CVEs — wpchill Modula Image Gallery – Photo Grid &…

In the same product, most dangerous first.

CVE-2024-12853HIGHModula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File UploadEPSS 0.9%CVE-2026-89406HIGHModula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' ParametersEPSS 0.4%CVE-2026-121976MEDIUMModula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' ParameterEPSS 0.3%CVE-2026-92713HIGHModula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' ParameterEPSS 0.3%CVE-2026-107659HIGHModula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPTEPSS 0.3%CVE-2025-12494MEDIUMImage Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File MoveEPSS 0.3%