CVE-2025-13645 Overview
CVE-2025-13645 is an arbitrary file deletion vulnerability in the Modula Image Gallery plugin for WordPress, developed by WPChill. The flaw exists in the ajax_unzip_file function in versions 2.13.1 through 2.13.2. Insufficient file path validation allows authenticated attackers with Author-level access or higher to delete arbitrary files on the server. When critical files such as wp-config.php are deleted, this condition can be escalated to remote code execution. The vulnerability is classified as [CWE-22] Path Traversal and affects WordPress sites running vulnerable Modula plugin installations.
Critical Impact
Authenticated attackers can delete arbitrary files on the WordPress server, leading to potential remote code execution by removing core configuration files such as wp-config.php.
Affected Products
- WPChill Modula Image Gallery plugin version 2.13.1
- WPChill Modula Image Gallery plugin version 2.13.2
- WordPress installations with vulnerable Modula plugin enabled
Discovery Timeline
- 2025-12-03 - CVE-2025-13645 published to NVD
- 2025-12-15 - Last updated in NVD database
Technical Details for CVE-2025-13645
Vulnerability Analysis
The vulnerability resides in the ajax_unzip_file function within class-modula-gallery-upload.php. The function processes file paths supplied through AJAX requests without sufficient validation or sanitization. An authenticated user with at least Author-level privileges can submit a crafted request that references file paths outside the intended upload directory.
Because the function performs deletion operations on these paths without verifying their location, attackers can target any file accessible to the web server process. Deleting wp-config.php triggers WordPress to enter the installation flow on next request, which an attacker can leverage to redirect the site to an attacker-controlled database, achieving full remote code execution.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The ajax_unzip_file handler accepts file path input from privileged users without canonicalizing the path or enforcing that it resides within the plugin's working directory. Without these checks, sequences such as ../ are accepted and resolved against the WordPress root.
Attack Vector
Exploitation requires Author-level authentication or higher on the target WordPress site. The attacker sends a crafted AJAX request to the vulnerable endpoint, supplying a relative or absolute path to the target file. The plugin processes the request and removes the referenced file. Detailed technical references are available at the Wordfence Vulnerability Analysis and the vulnerable code is visible in the WordPress Plugin Code Snippet.
No public proof-of-concept exploit code is available. The vulnerability mechanism centers on missing validation of user-controlled path parameters passed to file deletion operations within the AJAX handler.
Detection Methods for CVE-2025-13645
Indicators of Compromise
- Unexpected AJAX requests to the ajax_unzip_file action originating from Author-level or higher accounts
- Missing or recently deleted core WordPress files, particularly wp-config.php
- WordPress installation screen appearing unexpectedly, indicating loss of configuration
- Web server error logs showing file-not-found errors for previously existing plugin or core files
Detection Strategies
- Audit WordPress access logs for admin-ajax.php POST requests referencing Modula upload handlers with suspicious path parameters
- Monitor file integrity on WordPress installations, alerting on deletion of wp-config.php, .htaccess, or plugin files
- Review user role assignments and flag unexpected privilege grants to Author or higher roles
Monitoring Recommendations
- Deploy file integrity monitoring (FIM) on the WordPress document root with real-time alerting on deletions
- Forward web server and WordPress audit logs to a centralized SIEM for correlation of AJAX activity with file system events
- Establish a baseline for normal Modula plugin AJAX traffic and alert on path parameters containing traversal sequences such as ../
How to Mitigate CVE-2025-13645
Immediate Actions Required
- Update the Modula Image Gallery plugin to a version newer than 2.13.2 that includes the upstream patch
- Audit all WordPress accounts and remove unnecessary Author-level or higher privileges
- Verify the integrity of wp-config.php and other core files, restoring from backup if any deletions are detected
- Rotate database credentials and WordPress secret keys if compromise is suspected
Patch Information
The vendor addressed the flaw in WordPress plugin repository changesets. Patch details are available in the GitHub Commit Update, the WordPress Changeset 3395701, and the WordPress Changeset 3407949. The fix adds proper path validation to the ajax_unzip_file function to prevent traversal outside the intended upload directory.
Workarounds
- Temporarily deactivate the Modula Image Gallery plugin until patching is complete
- Restrict Author and higher role assignments to trusted users only
- Apply a web application firewall (WAF) rule to block AJAX requests to Modula handlers that contain path traversal sequences
- Set restrictive file system permissions on wp-config.php so the web server user cannot delete it
# Restrict wp-config.php permissions to prevent deletion by the web server user
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php
# Set the immutable attribute on Linux to block deletion
chattr +i /var/www/html/wp-config.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
