CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
A path traversal vulnerability in Image Gallery – Photo Grid & Video Gallery versions 2.13.1 through 2.13.2 allows authenticated administrators to read and write arbitrary files on the server. An attacker with admin privileges can bypass file access restrictions and access sensitive files outside the intended directory structure, potentially exposing configuration files, database credentials, or modifying site files.
What an attacker can do
Read and write arbitrary files on the server outside the gallery directory.
Potential impact on your site
An admin account compromise could expose sensitive files or allow modification of core site files.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
