CVE-2025-13646

🗓️ 03 Dec 2025 02:25:30Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 15 Views

CVE 2025-13646: Modula gallery allows authenticated upload of arbitrary files via race condition.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-13646	3 Dec 202504:34	–	circl
CNNVD	WordPress plugin Modula Image Gallery 代码问题漏洞	3 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-13646 Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition	3 Dec 202502:25	–	cvelist
EUVD	EUVD-2025-200723	3 Dec 202502:25	–	euvd
NVD	CVE-2025-13646	3 Dec 202503:16	–	nvd
OSV	CVE-2025-13646	3 Dec 202503:16	–	osv
Patchstack	WordPress Modula plugin 2.13.1-2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition vulnerability	3 Dec 202510:29	–	patchstack
Positive Technologies	PT-2025-48790	3 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-13646	4 Dec 202503:17	–	redhatcve
Vulnrichment	CVE-2025-13646 Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition	3 Dec 202502:25	–	vulnrichment

NVD

Vulners

Node

wpchill modula_image_galleryRange2.13.1–2.13.3wordpress

[
  {
    "vendor": "wpchill",
    "product": "Image Gallery – Photo Grid & Video Gallery",
    "versions": [
      {
        "version": "2.13.1",
        "status": "affected",
        "lessThanOrEqual": "2.13.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/59ee0ca2-846d-4ae8-ad19-7c3826861aeb
github	www.github.com/WPChill/modula-lite/commit/90c8eb982f71b31584d9be9359e3b594e03927d7
plugins	www.plugins.trac.wordpress.org/changeset/3395701/modula-best-grid-gallery
plugins	www.plugins.trac.wordpress.org/changeset/3407949/modula-best-grid-gallery
github	www.github.com/WPChill/modula-lite/blob/master/includes/admin/class-modula-gallery-upload.php

15 Dec 2025 15:41Current

7.1High risk

Vulners AI Score7.1

CVSS 3.16.6 - 7.5

EPSS0.00178

SSVC

CWE-434