CVE-2025-12494: WordPress Image Gallery File Deletion Flaw

CVE-2025-12494 Overview

The Image Gallery – Photo Grid & Video Gallery plugin (Modula Best Grid Gallery) for WordPress contains an authorization flaw in the ajax_import_file function. All versions up to and including 2.12.28 fail to properly validate file paths before performing file operations. Authenticated attackers holding author-level access or higher can move arbitrary image files on the server. The weakness is classified as improper authorization [CWE-285] and stems from missing path validation on user-supplied input. Successful exploitation impacts file integrity but does not directly expose data or crash the site.

Critical Impact
Authenticated users at author level or above can move arbitrary image files on the WordPress server, potentially disrupting site content or media library integrity.

Affected Products

Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress
All plugin versions up to and including 2.12.28
WordPress sites permitting author-level or higher registrations

Discovery Timeline

2025-11-15 - CVE-2025-12494 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12494

Vulnerability Analysis

The flaw resides in the ajax_import_file handler inside class-modula-gallery-upload.php. The function processes AJAX-driven import requests but does not sufficiently constrain the file path parameter to a safe directory. Because the handler proceeds without confirming that the target path belongs to the plugin's expected upload scope, an authenticated user can direct file-move operations against arbitrary image files elsewhere on the filesystem. The published references point to specific lines within the upload class (lines 554, 567, 589, and 597) that participate in the vulnerable flow. Exploitation requires an authenticated session at author level or higher, which raises the effective barrier compared to unauthenticated flaws but remains reachable on multi-author WordPress deployments.

Root Cause

The root cause is insufficient authorization and path validation in ajax_import_file. The function trusts caller-provided path input rather than resolving it against an allowlist of plugin-controlled directories. This maps to [CWE-285] Improper Authorization, since the code path performs privileged file operations without verifying that the target resource belongs to the requesting user's authorized scope.

Attack Vector

An attacker with author-level access authenticates to the target WordPress site, then issues a crafted request to the plugin's AJAX endpoint that invokes ajax_import_file with a path pointing at an image file outside the intended import location. Because the plugin does not normalize or validate the path, the file is moved from its original location. Repeated calls can relocate multiple image assets, disrupting media libraries or breaking site content.

// No verified proof-of-concept code is published for CVE-2025-12494.
// Refer to the Wordfence and CleanTalk advisories linked below for
// technical write-ups and the WordPress plugin repository for the
// vulnerable source lines.

See CleanTalk CVE-2025-12494 Analysis and Wordfence Vulnerability Report ID ca423309 for additional technical context.

Detection Methods for CVE-2025-12494

Indicators of Compromise

Unexpected AJAX POST requests to admin-ajax.php invoking the Modula ajax_import_file action from author-level accounts.
Image files disappearing from expected media library locations or appearing in unexpected paths under wp-content.
Modula plugin version at or below 2.12.28 present on the WordPress installation.

Detection Strategies

Review web server access logs for admin-ajax.php requests referencing Modula import actions with suspicious path parameters containing .. sequences or absolute paths.
Compare filesystem snapshots of wp-content/uploads against the media library database to identify files that were moved outside of normal user workflows.
Audit WordPress user roles and identify accounts with author privileges or above that were created or elevated recently.

Monitoring Recommendations

Enable WordPress activity logging for AJAX actions belonging to the Modula plugin and alert on high call volume from a single account.
Monitor file integrity across wp-content directories and flag unauthorized move operations against image assets.
Track plugin version inventory across WordPress estates to identify hosts still running Modula 2.12.28 or earlier.

How to Mitigate CVE-2025-12494

Immediate Actions Required

Upgrade the Modula Image Gallery plugin to a version later than 2.12.28 that contains the fix from changeset 3391790.
Audit all author-level and higher WordPress accounts and disable any that are unused or unrecognized.
Restore any misplaced image files from backup and verify media library consistency.

Patch Information

The vendor addressed the vulnerability in the Modula Best Grid Gallery repository via changeset 3391790. Site administrators should update the plugin through the WordPress plugin manager to receive the fix. Consult the Wordfence Vulnerability Report ID ca423309 for confirmed fixed versions.

Workarounds

Restrict author-level and higher role assignments to trusted users only while the patch is applied.
Deploy a web application firewall rule that blocks Modula AJAX import requests containing path traversal sequences.
Temporarily deactivate the Modula plugin on sites that cannot be updated immediately.

bash

# Update the Modula plugin via WP-CLI
wp plugin update modula-best-grid-gallery

# Verify installed version is above 2.12.28
wp plugin get modula-best-grid-gallery --field=version

# List author-level or higher accounts for review
wp user list --role=author --fields=ID,user_login,user_email,user_registered