Modula Image Gallery WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Modula Image Gallery plugin for WordPress, affecting all versions through 2.11.10. The issue arises from inadequate file type validation in the zip upload feature, which enables authenticated attackers with Author-level access or higher to upload arbitrary files to the server. This vulnerability could potentially lead to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the possibility of executing uploaded files on the server, depending on the file type and execution context.

Remediation

Users are advised to update the Modula Image Gallery plugin to version 2.11.11 or a newer patched version.