Modula Image Gallery: Code execution

Modula Image Gallery is affected by code execution. Exploitation requires at least author-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

CVE / CNA score 7.2 CVSS 3.1 · security@wordfence.com

NVD score Pending NVD has not published its own CVSS assessment.

Component: Modula Image Gallery
Plugin slug: modula-best-grid-gallery
Affected: See vendor advisory
Safe version: See mitigation notes
Published: Dec 03, 2025
Weakness: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

This CVE was published Dec 03, 2025 and is one of 10 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Modula Image Gallery to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Patch or disable the affected component.

Technical description

Primary and upstream sources