Executive Summary

This vulnerability is a Path Traversal issue in the Image Gallery – Photo Grid & Video Gallery plugin for WordPress, affecting all versions up to 2.13.3. It occurs because the modula_list_folders AJAX endpoint does not properly validate user-supplied directory paths or restrict them to safe base directories. Although it checks user capabilities (Author+ with upload_files and edit_posts permissions), it allows authenticated users with Author-level access or higher to enumerate arbitrary directories on the server.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Author-level access or higher can exploit this vulnerability to enumerate arbitrary directories on the server. This could lead to unauthorized disclosure of sensitive files or information stored on the server, potentially compromising the confidentiality of data.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if your WordPress installation is running the Image Gallery – Photo Grid & Video Gallery plugin version 2.13.3 or earlier. Since the vulnerability involves the modula_list_folders AJAX endpoint allowing directory enumeration by authenticated users with Author+ roles, you can monitor HTTP requests to this endpoint for suspicious directory traversal patterns. For example, use network monitoring tools or web server logs to look for requests to 'wp-admin/admin-ajax.php?action=modula_list_folders' with parameters containing '../' sequences or unusual folder paths. Additionally, you can run commands to check the installed plugin version, such as: `wp plugin list --format=json | jq '.[] | select(.name=="modula-best-grid-gallery")'` to verify the plugin version. If you have access to the server, you can also inspect the plugin files to confirm the version. However, no specific detection commands are provided in the resources. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Image Gallery – Photo Grid & Video Gallery plugin to version 2.13.4 or later, as this version includes security fixes that address the vulnerability by enforcing stricter permission checks and improved folder path validation. If updating immediately is not possible, restrict Author-level users from accessing the modula_list_folders AJAX endpoint or limit their permissions to prevent exploitation. Additionally, monitor and audit user activities related to gallery editing and file uploads to detect any suspicious behavior. [1]

Useful 0 Not Useful 0