CVE-2025-13891

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint that lacks proper path validation and base directory restrictions. While the endpoint verifies user capabilities (Author+ with upload_files and edit_posts permissions), it fails to validate that user-supplied directory paths reside within safe directories. This makes it possible for authenticated attackers, with Author-level access and above, to enumerate arbitrary directories on the server via the modula_list_folders endpoint.

• CWE-22

• https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L160
• https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L230
• https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L411
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3414176%40modula-best-grid-gallery%2Ftrunk&old=3407949%40modula-best-grid-gallery%2Ftrunk&sfp_email=&sfph_mail=
• https://research.cleantalk.org/cve-2025-13891/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/71e587ec-ceb6-48ca-9a1a-599d9d988b4d?source=cve

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13886The LT Unleashed plugin for WordPress is vulnerable to Local…7.5
• CVE-2025-13887The AI BotKit – AI Chatbot & Live Support for WordPress plug…6.4
• CVE-2025-13888A flaw was found in OpenShift GitOps. Namespace admins can c…9.1
• CVE-2025-13889The Simple Nivo Slider plugin for WordPress is vulnerable to…6.4
• CVE-2025-1389Orca HCM from Learning Digital has a SQL Injection vulnerabi…8.8
• CVE-2025-13890Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-13892The MG AdvancedOptions plugin for WordPress is vulnerable to…6.1
• CVE-2025-13893The Lesson Plan Book plugin for WordPress is vulnerable to R…6.1
• CVE-2025-13894The CSV Sumotto plugin for WordPress is vulnerable to Reflec…6.1
• CVE-2025-13895The Top Position Google Finance plugin for WordPress is vuln…6.1
• CVE-2025-13896The Social Feed Gallery Portfolio plugin for WordPress is vu…6.4
• CVE-2025-13897The Client Testimonial Slider plugin for WordPress is vulner…6.4