What the vulnerability does
01Description
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint that lacks proper path validation and base directory restrictions. While the endpoint verifies user capabilities (Author+ with upload_files and edit_posts permissions), it fails to validate that user-supplied directory paths reside within safe directories. This makes it possible for authenticated attackers, with Author-level access and above, to enumerate arbitrary directories on the server via the modula_list_folders endpoint.
Explanation of Vulnerability in Simple Terms
02Summary
The Modula Image Gallery plugin for WordPress contains a path traversal vulnerability that allows authenticated users with low privileges to read files outside the intended gallery directory. An attacker can access sensitive files on the server by manipulating file paths. This affects versions up to 2.13.3. Update to a version newer than 2.13.3 to resolve the issue.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from the server outside the gallery directory.
Potential impact on your site
04Site Impact
Sensitive files (config, database backups, private keys) may be exposed to low-privilege users.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
December 12, 2025
CVE published
April 8, 2026
Record updated
