CVE-2025-13646

MediumCVSS 6.6/10Last modified Oct 18, 2026

Description

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files with race condition on the affected site's server which may make remote code execution possible.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Dec 3, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-136486.1An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulne CVE-2025-136496.1An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the acti CVE-2025-13657.8A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file rea CVE-2025-136506.1An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action CVE-2025-136517.5Exposure of Sensitive System Information to an Unauthorized Actor vulnerability in Microcom ZeusWeb allows Web Application Fingerprinting of CVE-2025-136526.5The CBX Bookmark & Favorite plugin for WordPress is vulnerable to generic SQL Injection via the ‘orderby’ parameter in all versions up to, a CVE-2025-136534.3In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated CVE-2025-136547.5A stack buffer overflow vulnerability exists in the buffer_get function of duc, a disk management tool, where a condition can evaluate to tr CVE-2025-136566.4The Cute News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in all versions u CVE-2025-136574.3The HelpDesk contact form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This CVE-2025-136589.3A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the CVE-2025-136598.8Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthentic