Description

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and Authors trivially satisfy the edit_post check on their own galleries.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-25T08:16:41.310Z",
  "pubdate": "2026-09-25T08:16:41.310Z",
  "executiveSummary": "The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is susceptible to an arbitrary file deletion vulnerability in versions up to, and including, 3.0.2.\nThis vulnerability is classified as an improper neutralization of special elements used in a file path, allowing an authenticated attacker to delete critical files from the server's filesystem.\nThe flaw stems from insufficient validation of user-supplied input within the upload_image function, which fails to properly constrain file deletion operations to intended directories.\nAttackers with author-level access or higher can exploit this vulnerability because the existing path restrictions within the plugin do not effectively enforce ownership boundaries or prevent directory traversal.\nThe impact of this vulnerability is significant, as it enables unauthorized deletion of system files, plugin configurations, or other sensitive data, potentially leading to a complete denial-of-service condition or site instability.\nExploitation requires the attacker to be authenticated, specifically possessing at least the Author role, which is a common privilege level in many WordPress environments.",
  "technicalDetails": "The vulnerability resides within the upload_image function of the Modula Image Gallery plugin, which processes user requests for file handling. The primary security failure is a lack of rigorous input sanitization and path validation when processing deletion requests.\nWhile the plugin attempts to restrict operations to the wp-content/uploads directory, this mechanism is flawed. The validation logic fails to properly sanitize path traversal sequences, allowing an attacker to escape the designated upload directory.\nBecause WordPress Author-level users have sufficient privileges to execute certain post-editing and gallery-management functions, they can invoke the vulnerable upload_image function. Since these users satisfy the internal edit_post capability checks required by the plugin's code, they can initiate a request to delete files associated with their galleries or, through path manipulation, files residing elsewhere on the server filesystem.\nThe exploitation flow begins with the attacker constructing a malicious payload that includes path traversal characters (e.g., ../) to bypass the intended directory boundary. By manipulating the parameters passed to the upload_image function, the attacker forces the underlying filesystem API to target a file outside the authorized scope.\nUpon successful execution, the application processes the request with the privileges of the web server user (e.g., www-data), granting it the ability to delete any file accessible to that user account. This does not require external network exposure beyond the standard WordPress administrative or author access interfaces.\nThe impact is not limited to the deletion of media items; if the server's directory structure allows, attackers could target core configuration files, theme assets, or other plugin files. This leads to severe operational disruption, potential remote code execution by deleting security-related files, or a full denial-of-service by removing critical WordPress components required for site operation. The failure to treat the wp-content/uploads path as a strict sandbox facilitates this arbitrary file removal, as the plugin relies on insecure logic for enforcing resource ownership."
}