Vulnerability Description
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint that lacks proper path validation and base directory restrictions. While the endpoint verifies user capabilities (Author+ with upload_files and edit_posts permissions), it fails to validate that user-supplied directory paths reside within safe directories. This makes it possible for authenticated attackers, with Author-level access and above, to enumerate arbitrary directories on the server via the modula_list_folders endpoint.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26
- https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26
- https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new
- https://research.cleantalk.org/cve-2025-13891/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/71e587ec-ceb6-48ca-9a1
FAQ
What is CVE-2025-13891?
CVE-2025-13891 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint t...
How severe is CVE-2025-13891?
CVE-2025-13891 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-13891?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.