CVE-2025-13322: WP AUDIO GALLERY Path Traversal Flaw

CVE-2025-13322 Overview

The WP AUDIO GALLERY plugin for WordPress contains an arbitrary file deletion vulnerability affecting all versions up to and including 2.0. The flaw resides in the wpag_uploadaudio_callback() AJAX handler, which fails to validate user-supplied file paths in the audio_upload parameter before passing them to PHP's unlink() function. Authenticated attackers with subscriber-level access or higher can delete arbitrary files on the server. Deleting critical files such as wp-config.php can escalate to remote code execution by forcing WordPress into its installation flow. This issue is categorized under [CWE-73] (External Control of File Name or Path).

Critical Impact
Authenticated subscribers can delete arbitrary server files, enabling site takeover and remote code execution through deletion of wp-config.php.

Affected Products

WP AUDIO GALLERY plugin for WordPress — all versions up to and including 2.0
WordPress installations exposing subscriber registration with the plugin enabled
Sites relying on the wpag_uploadaudio_callback() AJAX endpoint

Discovery Timeline

2025-11-21 - CVE-2025-13322 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13322

Vulnerability Analysis

The vulnerability resides in the wpag_uploadaudio_callback() AJAX handler of the WP AUDIO GALLERY plugin. The handler accepts an audio_upload parameter from the client and passes the value directly into PHP's unlink() function without sanitization or path validation. Because the endpoint is accessible to any authenticated user, including subscribers, the authorization barrier is minimal on sites that allow open registration.

An attacker supplies a path traversal sequence such as ../../../wp-config.php in the audio_upload parameter. The plugin resolves this relative to a writable location and deletes the targeted file. Deletion of wp-config.php triggers WordPress to enter its setup state on the next request, allowing an attacker to reconfigure the database connection and achieve code execution.

Root Cause

The root cause is missing file path validation before invoking a sensitive file system operation. The plugin does not enforce an allowlist of deletable paths, does not canonicalize the supplied path, and does not verify that the target file belongs to plugin-managed content. The authorization check on the AJAX endpoint stops at WordPress's is_user_logged_in() equivalent rather than enforcing an administrator capability check such as manage_options.

Attack Vector

Exploitation requires only a valid WordPress account at subscriber level or above. The attacker authenticates, obtains a valid nonce for the AJAX action, then issues a POST request to admin-ajax.php with action=wpag_uploadaudio and a traversal payload in audio_upload. The server deletes the referenced file. Repeating the request against wp-config.php, .htaccess, or plugin files enables denial of service, security control bypass, or full site compromise.

Technical references are available in the WordPress plugin source at line 150, line 513, and line 607, as well as the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-13322

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=wpag_uploadaudio paired with traversal sequences such as ../ in the audio_upload parameter.
Unexpected deletion or absence of wp-config.php, .htaccess, or core WordPress files following subscriber-level activity.
WordPress installation prompts appearing on a previously configured site, indicating wp-config.php removal.
New subscriber accounts created shortly before file system anomalies on sites with open registration.

Detection Strategies

Inspect web server access logs for admin-ajax.php requests carrying the wpag_uploadaudio action and flag any payload containing .. or absolute paths.
Deploy file integrity monitoring on the WordPress root and wp-content/plugins directories to alert on unexpected file deletion events.
Correlate authenticated session activity from low-privilege accounts with file system change events on the host.

Monitoring Recommendations

Enable verbose WordPress and PHP error logging to capture failed unlink() operations and missing file warnings.
Stream web access logs, authentication events, and host file system telemetry into a centralized analytics platform for cross-source correlation.
Alert on the creation of install.php-driven setup sessions on production sites, which signals a deleted wp-config.php.

How to Mitigate CVE-2025-13322

Immediate Actions Required

Deactivate and remove the WP AUDIO GALLERY plugin until a patched version is published by the vendor.
Disable open user registration or restrict the default new user role to a value that cannot reach the vulnerable AJAX action.
Audit existing user accounts and remove any unrecognized subscriber-level users.
Back up wp-config.php, .htaccess, and the database, then verify file integrity against a known-good baseline.

Patch Information

At the time of publication, no fixed version of the WP AUDIO GALLERY plugin is listed in the Wordfence Vulnerability Report. All versions through 2.0 remain vulnerable. Monitor the WordPress plugin repository for an updated release and apply it immediately when available.

Workarounds

Remove or rename the plugin directory at wp-content/plugins/wp-audio-gallery/ to disable the vulnerable AJAX handler.
Block requests to admin-ajax.php containing action=wpag_uploadaudio at the web application firewall layer.
Apply filesystem-level controls so the PHP process cannot delete files outside the wp-content/uploads directory.
Set the WordPress DISALLOW_FILE_MODS constant in wp-config.php to restrict plugin-driven file modifications where feasible.

bash

# Configuration example: WAF rule to block exploit attempts
# ModSecurity rule
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,id:1013322,phase:2,deny,status:403,msg:'Block CVE-2025-13322 exploit attempt'"
  SecRule ARGS:action "@streq wpag_uploadaudio" \
    "chain"
    SecRule ARGS:audio_upload "@rx (\.\./|\.\.\\|/wp-config\.php)"