CyberRota Analysis
AI-GeneratedThe Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to inadequate file path validation in the upload_image function, affecting all versions up to 3.0.2. Authenticated attackers with author-level access can exploit this vulnerability to delete arbitrary files on the server, potentially leading to data loss or service disruption. WordPress site administrators and users of the Modula plugin should prioritize applying the latest updates to mitigate this high-severity risk.
Original NVD Description
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and Authors trivially satisfy the edit_post check on their own galleries.